gVisor in CI: sandboxing untrusted code on GitHub Actions

How kadet-hub runs untrusted contributor code in CI inside a gVisor sandbox on GitHub Actions, what it adds over a plain container and what it misses.