Store `logrotate` config in memfd file instead of container's sandbox.
Store `logrotate` config in memfd file instead of container's sandbox.

Previously, logrotation module stored the `logrotate` configuration
file in container's sandbox directory, so that it was garbage collected
together with the container's sandbox. If the container's task had
permissions to modify this configuration file, it was possible to run
any command under an unprivileged user. This patch stores `logrotate`
config in an nonymous temporary file via `memfd`, so logrotation module
can pass a path to procfs instead of container's sandbox. This approach
solves the aforementioned security issue on Linux when the
`ENABLE_LAUNCHER_SEALING` configuration flag is specified.

Review: https://reviews.apache.org/r/70010/

chhsia0/mesos,abudnik/mesos,dforsyth/mesos,jpeach/mesos,kaysoky/mesos,dforsyth/mesos,reneploetz/mesos,Gilbert88/mesos,jpeach/mesos,dforsyth/mesos,gsantovena/mesos,abudnik/mesos,jpeach/mesos,gsantovena/mesos,jpeach/mesos,Gilbert88/mesos,gsantovena/mesos,abudnik/mesos,reneploetz/mesos,Gilbert88/mesos,Gilbert88/mesos,reneploetz/mesos,dforsyth/mesos,chhsia0/mesos,jpeach/mesos,gsantovena/mesos,dforsyth/mesos,jpeach/mesos,reneploetz/mesos,dforsyth/mesos,kaysoky/mesos,kaysoky/mesos,gsantovena/mesos,gsantovena/mesos,gsantovena/mesos,reneploetz/mesos,Gilbert88/mesos,kaysoky/mesos,reneploetz/mesos,jpeach/mesos,dforsyth/mesos,chhsia0/mesos,abudnik/mesos,abudnik/mesos,chhsia0/mesos,kaysoky/mesos,kaysoky/mesos,chhsia0/mesos,kaysoky/mesos,reneploetz/mesos,abudnik/mesos,Gilbert88/mesos,chhsia0/mesos,chhsia0/mesos,abudnik/mesos,Gilbert88/mesos