Mount /proc in linux-sandbox with Recursive Bind option

[Ryang20718]

Currently on Bazel 6.0.0

Problem: Due to Nvidia Runtime Mounting Proc, when running bazel within a docker container, we hit

src/main/tools/linux-sandbox-pid1.cc:441: "mount": Operation not permitted

We see that there's a nested proc mount

unshare --mount --map-root-user --pid --fork
# mount | grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /proc/driver/nvidia type tmpfs (rw,nosuid,nodev,noexec,relatime,mode=555,inode64)
proc on /proc/driver/nvidia/gpus/0000:b3:00.0 type proc (ro,nosuid,nodev,noexec,relatime)

Whilst I know this is nvidia problem and limited to local execution, it would be nice to be able to use linux-sandbox within a docker container w/ access to Nvidia runtime.

Proposal:
Add recursive bind option when mounting proc.
Given that proc is mounted as read only, I don't think the recursive mount would be an issue?

I have a PR outlining this simple fix. #18069. Wondering if this is something that can get shipped upstream or whether we'd need to maintain a patch ourselves

[meisterT]

cc @larsrc-google