Add validators for exec_input, exec_memory_thp, exec_cpu_affinity, syscall_archs, colon_separated_paths, user_group_strv_compat

[SJrX]

Goal

Batch 5 of 5. Final batch to push the burn-down comfortably past July.

Targets

Function	Usages	C source	Approach
config_parse_exec_input(0)	5	load-fragment.c:1124	fd:NAME OR file:/PATH OR enum from exec_input_table
config_parse_exec_memory_thp(0)	5	load-fragment.c:170 (DEFINE_CONFIG_PARSE_ENUM)	Enum from exec_memory_thp_table: inherit/disable/madvise/system
config_parse_exec_cpu_affinity(0)	5	load-fragment.c:1822	"numa" OR CPU set list (delegates to config_parse_unit_cpu_set)
config_parse_syscall_archs(0)	5	load-fragment.c:3377 → seccomp_arch_from_string	List of ~22 named archs
config_parse_colon_separated_paths(0)	5	load-fragment.c:448	Colon-separated absolute paths (specifier-aware)
config_parse_user_group_strv_compat(0)	5	load-fragment.c:2519 → valid_user_group_name(VALID_USER_RELAX|...)	Whitespace-separated user/group names (relaxed validity)

Skipped

• config_parse_exec_coredump_filter(0) (5 uses) — accepts filter names PLUS arbitrary uint64 hex/dec; would loosen the grammar significantly
• config_parse_exec_selinux_context(0), config_parse_exec_smack_process_label(0) (5 each) — SELinux/SMACK context strings, defer
• config_parse_exec_root_hash(0), config_parse_exec_root_hash_sig(0) (5 each) — base64-ish, defer
• config_parse_extension_images(0), config_parse_mount_images(0), config_parse_root_image_options(0), config_parse_temporary_filesystems(0) (5 each) — path + mount-option syntax, defer
• config_parse_*_credential(0/1) — credential identifier + source, defer