Support the Apple Container tool for sandboxing

[ptone]

What would you like to be added?

Apple has produced a new tool at https://github.com/apple/container to manage OCI containers using lightweight VM and small linux kernel per running container.

The CLI tool is largely compatible with the Docker command for image management.

Why is this needed?

Sandobxing and security continue to be a primary concern of users who want to apply the CLI to production uses. The existing MacOS of seatbelt sandboxing is relatively difficult to administer, and does not allow shared organizational investment in things like custom dev containers.

Additional context

An initial implementation is available in https://github.com/ptone/gemini-cli/tree/apple-container-sandbox

A PR to be opened after some initial internal review