[19.03 backport] Update containerd to v1.2.8

[thaJeztah]

backport of moby#39364 and moby#39786 for 19.03

From the release notes: https://github.com/containerd/containerd/releases/tag/v1.2.7

Welcome to the v1.2.7 release of containerd!

The seventh patch release for containerd 1.2 introduces OCI image
descriptor annotation support and contains fixes for containerd shim logs,
container stop/deletion, cri plugin and selinux.

It also contains several important bug fixes for goroutine and file
descriptor leakage in containerd and containerd shims.

Notable Updates

• Support annotations in the OCI image descriptor, and filtering image by annotations. [release/1.2 backport] Add missing annotations map to Descriptor for gRPC transfer  containerd/containerd#3254
• Support context timeout in ttrpc which can help avoid containerd hangs when a shim is unresponsive. Add support for request timeout propgation. containerd/ttrpc#31
• Fix a bug that containerd shim leaks goroutine and file descriptor after containerd restarts. Handle EOF to prevent file descriptor leak containerd/ttrpc#37
• Fix a bug that a container can't be deleted if first deletion attempt is canceled or timeout. [release/1.2] Return NotFound error for kill and delete in deleted state. containerd/containerd#3264
• Fix a bug that containerd leaks file descriptor when using v2 containerd shims, e.g. containerd-shim-runc-v1. [cherry-pick release/1.2] Fix fd leak of shim log containerd/containerd#3273
• Fix a bug that a container with lingering processes can't terminate when it shares pid namespace with another container. docker cannot terminate a container when processes linger after TERM moby/moby#38978
• Fix a bug that containerd can't read shim logs after restart. [cherry-pick release/1.2] containerd-shim: redirect output into stdout fifo containerd/containerd#3282
• Fix a bug that shim_debug option is not honored for existing containerd shims after containerd restarts. [cherry-pick release/1.2] v1: Respect the shim_debug flag when load tasks containerd/containerd#3283
• cri: Fix a bug that a container can't be stopped when the exit event is not successfully published by the containerd shim. Cannot stop the container: stop timeout containerd/containerd#3125, Containers can't be stopped because TaskExit event failed to be published for runc.v2. containerd/containerd#3177
• cri: Fix a bug that exec process is not cleaned up if grpc context is canceled or timeout. contaienrd/cri#1159
• Fix a selinux keyring labeling issue by updating runc to v1.0.0-rc.8 and selinux library to v1.2.2. fix can't use empty str as label in some old kernels opencontainers/selinux#50
• Update ttrpc to f82148331ad2181edea8f3f649a1f7add6c3f9c2. [release/1.2] cherry-pick: Bump ttrpc containerd/containerd#3316
• Update cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88. [release/1.2] Update cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88 containerd/containerd#3330

[thaJeztah]

marked as "WIP" because upstream wasn't merged yet, and this should probably go out with the upcoming 19.03.1 patch release after GA

[thaJeztah]

Marked as "WIP" because this will go out with the first patch release of 19.03

[kolyshkin]

LGTM

[thaJeztah]

all green; merging this one, then I'll rebase #349