docs: security: communication between the host and the pod

[alban]

There are a number of communication channels between the host and the pod that are not all obvious. They should be documented.

Examples:

• using host volumes. This gives the pod access to host files. Related discussions: documentation: security best practices for volumes #735 Breaking out of Docker into real file system. moby/moby#12317
• nspawn’ s incoming mounts feature with "machinectl bind", shared abstract socket with --net=host.
• list of fds from the host passed to the pod (e.g. socket activation)
• or vice versa (e.g. rtnetlink, future sd_notify)
• stage1: add pod mutability as a service #2867

[s-urbaniak]

as discussed OOB with @lucab more investigation is needed, hence moving.

[alban]

• rkt metadata-service