Add new version of the restricted kernel simple_io and initrd

[jul-sh]

the new oak_restricted_kernel_simple_io_init_rd_wrapper will exist alongside oak_restricted_kernel_simple_io_wrapper for a while. then internal dependencies will be updated, and the the former will be removed.

this approach is significantly simpler than #4828. For #4828 we would need to attempt to synchronize its merging with the updates to the internal launcher and the transparent release imports of the binary. It'd be too flaky.