Kernel filesystem change

[ShaleXIONG]

Rework entirely on the execution engines and modify the policy accordingly.

• Remove the support of WASMI since it only has an experimental support to WASI.
• Remove the in-memory file system (FS) internally in Veracruz. For the remaining WASM engine, Wasmtime, we revert to the default implementation of WASI directly provided by the engine; such implementation links WASI calls to the kernel filesystem.
• Rework on the Sandbox, to execute native binary. Remove all steps of copying between (no long exist) in-memory FS.
• Rework on native module. It is renamed to "service". Now individual service which is excused in a separate thread, monitors a named pipe file, input, under the mounted directory, specified in the policy file. Any caller of this service should read output under the mounted directory.
• WASM engine, Sandbox and services are now unified to the same trait, Execution, which requires two methods, name returning the name of this execution, and execute executing a path to a file, or a directory. The later case is useful for service, which is mounted in a directory.
• Rework on the policy. Remove the old native module field, but treat native binary as a program too. For the service, we introduce a new service field, to specify the name of this service, and the mounted directory. Execution engine will mounted the service based on the name (matching). Also rework the permission specification, it uses rwx. Remove the old capability parameter, but combine the permission with entity by => symbol, for example "<CLIENT_CERT> => output:r, input:w".

Minor:

• Rework policy generator and freestanding execution engine. Simplify the use of clap by using the derive features.