We are seeing that the CRIU fork requires continuous synchronization to stay up to date with new kernels. Rather than maintaining the fork in a side-repo we should upstream the changes and use the one readily available in packaging systems. Testing shows that we can use the current version (tested 4.1.1 and 4.2), adding the `--unprivileged` option.

Let's stop bundling CRIU into $JAVA_HOME/lib folder, and use what is available on the $PATH. Users will still be able to select alternative executable (including the released versions of CRaC fork) via `-XX:CRaCEngineOptions=criu_location=/path/to/criu`.