[Request]: Add OCI `maskedPaths` and `readonlyPaths` support to Container API.

[jglogan]

Feature or enhancement request details

apple/containerization#795 added support for the OCI maskedPaths and readonlyPaths container configuration fields, and set the default to make /proc/sys readonly.

As a first step, we should plumb these options up to ContainerConfiguration in the client API.

CLI plumbing for OCI options we should consider more generally, as a follow-on (see #1595).

Code of Conduct

• I agree to follow this project's Code of Conduct