Add --airgap flag

[lukechilds]

This should disable networking on the container as a pseudo airgap.

Could be useful if you want to run an untrusted binary that needs access to something sensitive like PGP keys.

[lukechilds]

In fact this already works with dosh --network none, no need to complicate it with extra args, we should document this.