Support running Middleware in Sandboxes

[kirit93]

Problem Statement

OpenShell users should be able to run a middleware service in a sandbox so they can apply an OpenShell policy to the middleware service as well.

Proposed Design

Need a design proposal.

Alternatives Considered

Running middleware unsandboxed is an option, but it requires users to trust their middleware services.

Agent Investigation

No response

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request

[pimlock]

Great idea!
Adding a related item: #1049