Isolate Docker workspaces by default

[kexinoh]

Summary

• Create a private bridge network for each Docker workspace by default.
• Add an offline mode that disables bridge IP masquerading while keeping the loopback control port available.
• Bind published control ports to loopback and generate a per-workspace session key.
• Clean up containers and networks reliably on startup and shutdown failures.

Validation

• uv run ruff check openhands-workspace/openhands/workspace/docker/workspace.py tests/workspace/test_docker_workspace.py
• uv run pytest tests/workspace/test_docker_workspace.py -q (18 passed)

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.