[feature req] add a trustless regime/mode; improve sandbox usecase ergonomics

gvisor-tap-vsock is almost perfect but some functionality is lacking for a sandbox usecase:

• expose a TUN interface (instead of TAP) for the sole purpose of giving a sandbox internet access and no other net access. (another project that also uses gvisor's netstack and accomplished this: github.com/xjasonlyu/tun2socks )
• remove IP assignment requirement (static & dhcp)
• restrict access level of the socket (make only /connect available)

example workflow:

on the host: gvproxy -listen unix:///path/gvproxy/test

inside a sandbox with /path/gvproxy/test shared: gvforwarder -url unix:///path/gvproxy/test -iface tap0 -preexisting

currently, every sandbox needs to have its IPs managed (when dhcp isn't an option) and can get too much info by talking to the socket. currently if two sandboxes connect to gvproxy/test socket with their tap0's having the same IP routing of one will fail.

would be ideal if it were something like

gvforwarder -url unix:///path/gvproxy/test -iface tun0 -preexisting

where tun0 is just a result of some generic mktun script and

ip addr add [anything] dev tun0
route add default via [anything] dev tun0

another helpful option would be if gvforwarder could be made to accept an FD for tun/tap. some sandboxes have the ability to create a tun/tap interface rootlessly then further drop capabilities but pass the created FD onward.