fix(api): carry creation-time env vars through resume

[YidaWeng]

Attempt at e2b-dev/E2B#1947: creation-time env vars go missing after a resume that self-upgrades envd.

Problem

The envd upgrade handover deliberately omits env vars and relies on the post-upgrade /init to restore them. On resume, buildResumeSandboxDataFromSnapshot builds SandboxMetadata without EnvVars, so that /init has nothing to restore.

Approach

• sandbox_create.go: merge the request's envVars into the sandbox metadata so they are persisted with the snapshot.
• sandbox_resume.go: read them back from snapshot metadata and pass them as SandboxMetadata.EnvVars, so the orchestrator sends them to /init.

No proto, orchestrator, or envd changes.

Known limitations (feedback welcome)

• Env vars, which may hold secrets, become visible wherever sandbox metadata is exposed (get/list responses, metadata filters).
• On resume, all metadata is treated as env vars, so user metadata also ends up in the environment, and an env var can overwrite a metadata key with the same name.
• Verified only by go build / go vet; no tests yet, and I could not exercise the managed envd upgrade path.

#3673 tackles the same issue in the orchestrator by capturing /envs before the upgrade, which avoids the limitations above. Opening this as a draft for reference and discussion; happy to close it in favour of #3673 or rework it based on feedback.

Refs e2b-dev/E2B#1947