feat: add missing HostConfig fields to dockercompat inspect response

[ayush-panta]

This PR populates missing HostConfig fields in the dockercompat inspect response, bringing nerdctl inspect --mode=dockercompat closer to what consumers expect from Docker's GET /containers/{id}/json.

All data comes from sources already available in ContainerFromNative() via the OCI spec and container labels.

OCI spec fields: PidsLimit, Ulimits, MemoryReservation, MemorySwappiness, and Annotations. Ulimits are converted from OCI RLIMIT_* format to Docker's lowercase format (inverse of run_ulimit_linux.go). Annotations are filtered to exclude nerdctl/ prefixed internal entries.

Label-based fields: NetworkMode (from nerdctl/networks), RestartPolicy (parsed from containerd.io/restart.policy via restart.NewPolicy()), and AutoRemove (from nerdctl/auto-remove). These labels already exist — we're just populating the fields.

Privileged: The OCI spec doesn't store a "privileged" flag; it just applies all caps and device access. Inferring that from the spec is fragile, so we store a nerdctl/privileged label at creation time and read it back at inspect. This required minor additions to create.go and labels.go.

CapAdd/CapDrop: nerdctl doesn't persist the original --cap-add/--cap-drop flags; only the resulting OCI bounding set survives. We reconstruct by diffing the bounding set against containerd's 14 default capabilities (containerd source, moby source — same set). Caps in bounding but not in defaults → CapAdd. Defaults not in bounding → CapDrop. There's a slight difference from Docker when --cap-add ALL is used: Docker stores and returns the literal ["ALL"], while we show the expanded list since we only have the OCI spec. This is functionally equivalent.

Testing:

• Unit: TestGetCapabilitiesFromNative (7 cases), TestGetUlimitsFromNative (4 cases), extended "container from nerdctl" in TestContainerFromNative with all new fields.
• Integration: extended TestContainerInspectHostConfig with resource and label flags + assertions, extended TestContainerInspectHostConfigDefaults with zero-value checks. Added TestContainerInspectHostConfigPrivileged (rootful only) and TestContainerInspectHostConfigCapabilities as separate tests since privileged requires root and conflicts with cap flags.

[ayush-panta]

CI is green on relevant tests; remaining failures seem to be due to flakiness/are unrelated to my changes. Ready for review.