Add an option to use contracts on illumos

[sunshowers]

Seems like the better way to do it, and depending on how things go we may also want to make it the default.

From @jclulow:

I think contracts is probably what you want, generally; it's much easier to make sure something doesn't escape, and you can listen to events around processes dumping core, etc

buildomat currently does a very early draft implementation of using contracts to run what we're told to run by the user; e.g., https://github.com/oxidecomputer/buildomat/blob/main/agent/src/exec.rs#L398-L416

There are library interfaces and so on but we're just using ctrun(1) there today because it was expedient