Add validators for private_users, managed_oom_rules, restrict_network_interfaces, bind_network_interface, working_directory, unit_env_file

[SJrX]

Goal

Batch 3 of 5. Continues extending the OptionValueTest burn-down through July.

Targets

Function	Usages	C source	Approach
config_parse_private_users(0)	6	src/nspawn/nspawn-settings.c:660	boolean OR "pick"/"identity" OR uint32(:uint32)?
config_parse_managed_oom_rules(1)	6	src/core/load-fragment.c:4093	List of filename-safe rule names (string_is_safe(STRING_FILENAME))
config_parse_restrict_network_interfaces(0)	6	src/core/load-fragment.c:5908	Optional ~ + whitespace-separated ifname_valid_full(IFNAME_VALID_ALTERNATIVE) names
config_parse_bind_network_interface(0)	6	src/core/load-fragment.c:6036	Single ifname_valid_full(ALTERNATIVE) (specifier-aware)
config_parse_working_directory(0)	5	src/core/load-fragment.c:2576	Optional - + ~ OR absolute path
config_parse_unit_env_file(0)	5	src/core/load-fragment.c:2637	Optional - + absolute path

Skipped from candidates

• config_parse_log_filter_patterns(0) — value is a PCRE2 regex; can't validate a regex with a regex meaningfully without compiling
• config_parse_io_device_weight(0), config_parse_io_device_latency(0) — path + (weight|latency) with specifier-expanded paths, deferred to a later batch
• config_parse_path_spec(0) — abstract socket path syntax variants, deferred
• config_parse_cgroup_nft_set(NFT_SET_PARSE_CGROUP) — nftables set syntax, defer