benchmarking/atunnel: atunnel CPU and memory benchmark - #2761

The first pieces of a benchmark that measures atunnel's CPU and memory on
its own: the peers atunnel talks to, the plumbing every benchmark process
shares, and the atunnel-bench program, which runs each process as a Cobra
subcommand.

- pki writes throwaway certificates shaped like the cluster's: a worker
  Pod certificate and an atelet certificate carrying Pod identities on the
  same node, as atunnel's atelet client checks, plus router and gateway
  certificates. atunnel-bench pki writes them.
- fakeatelet serves the two WorkerSupport calls atunnel makes, actor
  certificate minting and egress policy, so atunnel's own broker client
  runs unchanged.
- sink is the far end: an ingress actor, standing in for an actor's
  program receiving requests, and a fake egress gateway that accepts
  CONNECT over HTTP/2 and HTTP/1.1 with the real gateway's Envoy HTTP/2
  settings, answering or discarding by destination port. atunnel-bench
  sink runs the gateway.
- procstats reads a process's CPU, memory, goroutines, and its own cgroup
  v2 accounting, and serves them on /stats.

atunnel-bench tunnel starts atunnel and hosts actors with the calls
cmd/ateworker-gvisor makes, in its order: tunnel.Start with the worker's
own flags, then per actor PrepareEgress, actornet.ServeSandbox, and
Activate. Each actor gets real network namespaces, the nftables redirect,
and a certificate minted through atunnel's atelet client; only gVisor is
missing: an ingress actor, a small server, stands in for each actor's
program. The process runs nothing but atunnel, so its CPU and memory are
atunnel's.

atunnel-bench worker plays the rest of the worker pod in a privileged
container: the fake atelet, atunnel in a cgroup of its own with CPU and
memory limits and no swap, the ingress actors placed in every sandbox and
the egress actor in the first, and a fresh atunnel when one dies, with its
OOM kills logged. It starts atunnel and the actors from its own
executable. run-docker.sh runs the worker, the fake gateway, and the
generator as three containers.

Since every process is a subcommand of the one program, atunnel's process
also holds the others' code, which it never runs: at idle, hosting 10
actors, it holds about 29 MB resident against 26 MB built on its own.

The depguard rule that keeps internal/ateworker to the worker binaries
gains an exception for this benchmark, which hosts atunnel as a worker
does.

A full run of every scenario with atunnel limited to 1 CPU and 1 GiB:
results.txt is the generator's output, report.md explains it for readers
new to atunnel, with two findings: each idle egress connection holds about
157 KB of buffers, and ingress over HTTPS opens a new connection to the
actor for many requests under load, since atunnel keeps only two spare
connections per actor.