### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

To enable running a debugger (e.g. [delve](https://github.com/go-delve/delve)) in a container running in ECS in Localstack the container needs certain security related options. This includes adding the `SYS_PTRACE` permission, and on Linux, running with an apparmor profile that allows the container to run tracing.

Task definitions in AWS supports setting these options through the `dockerSecurityOptions` and `linuxParameters`.

These fields are currently not propagated to a container started in Localstack, which prevents doing remote debugging of containers in Localstack ECS.

Here is a task definition containing setting for added permissions, and specifying an apparmor profile.

```json
{
  "taskDefinition": {
    "taskDefinitionArn": "arn:aws:ecs:us-east-1:000000000000:task-definition/rest-api-8aa8c290507be0b4:1",
    "containerDefinitions": [
      {
        "name": "app",
        "image": "localhost:4510/rest-api-registry-232449743180e1e4:b2e51cf4c154aa1b6efeb744a47fd7d6",
        "cpu": 256,
        "memoryReservation": 512,
        "portMappings": [
          {
            "containerPort": 8080
          },
          {
            "containerPort": 2345
          }
        ],
        "essential": true,
        "mountPoints": [],
        "volumesFrom": [],
        "linuxParameters": {
          "capabilities": {
            "add": [
              "SYS_PTRACE"
            ]
          },
          "initProcessEnabled": true
        },
        "disableNetworking": false,
        "privileged": false,
        "readonlyRootFilesystem": false,
        "dockerSecurityOptions": [
          "apparmor:unconfined"
        ],
        "interactive": false,
        "pseudoTerminal": false,
        "logConfiguration": {
          "logDriver": "awslogs",
          "options": {
            "awslogs-group": "/aws/ecs/app/20220203134424131100000003",
            "awslogs-region": "us-east-1",
            "awslogs-stream-prefix": "app"
          }
        }
      }
    ],
    "family": "rest-api-8aa8c290507be0b4",
    "taskRoleArn": "arn:aws:iam::000000000000:role/rest-api-role-20220203134423848400000002",
    "executionRoleArn": "arn:aws:iam::000000000000:role/rest-api-8aa8c290507be0b4",
    "networkMode": "awsvpc",
    "revision": 1,
    "volumes": [],
    "status": "ACTIVE",
    "placementConstraints": [],
    "compatibilities": [
      "EC2",
      "FARGATE"
    ],
    "requiresCompatibilities": [
      "FARGATE"
    ],
    "cpu": "1024",
    "memory": "2048"
  }
}
```

A container started with these settings should contain the following output when inspecting.

```json
[
    {
       ...
        "HostConfig": {
            "CapAdd": [
                "SYS_PTRACE"
            ],
            "SecurityOpt": [
                "apparmor:unconfined"
            ],
        }
       ...
    }
]
```

### 🧑‍💻 Implementation

The relevant settings can be set with the Docker CLI using `--security-opt="apparmor=unconfined"` and `--cap-add=SYS_PTRACE`.

For the [Docker Remote API](https://docs.docker.com/engine/api/v1.38/#operation/ContainerCreate), `dockerSecurityOptions` maps to `SecurityOpt` while `linuxParameters` would go under `CapAdd` or `CapDrop`, both under `HostConfig`.

### Anything else?

A guide to running the Delve debugger in a container: https://blog.jetbrains.com/go/2020/05/06/debugging-a-go-application-inside-a-docker-container/#changing-the-run-configuration

Task definition security parameters: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security
Task definition linux parameters: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#other_container_definition_params
if interactive and stdin:  
                sock = result[1]
                sock = sock._sock if hasattr(sock, "_sock") else sock
                with sock:
                    try:
                        sock.sendall(stdin)
                        sock.shutdown(socket.SHUT_WR)
                        stdout, stderr = self._read_from_sock(sock, tty)
                        return stdout, stderr
                    except socket.timeout:
                        pass
            else:
                if detach:
                    return b"", b""
                return_code = result[0]
                if isinstance(result[1], bytes):
                    stdout = result[1]
                    stderr = b""
                else:
                    stdout, stderr = result[1]
                if return_code != 0:
                    raise ContainerException(
                        "Exec command returned with exit code %s" % return_code, stdout, stderr
                    )
                return stdout, stderr
        except ContainerError:
            raise NoSuchContainer(container_name_or_id)
        except APIError:
            raise ContainerException()