server/container_create: Mask /proc/keys
From Justin Cormack [1]:
> This leaks information about keyrings on the host.  Keyrings are not
> namespaced.
[1]:
@@ -1044,6 +1044,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
for _, mp := range []string{
"/proc/acpi",
"/proc/kcore",
+ "/proc/keys",
"/proc/latency_stats",
"/proc/timer_list",
"/proc/timer_stats",
