feat(docker,podman): add SELinux label support for bind mounts

[bergmannf]

Summary

Add optional selinux_label field to bind mount driver configs for both Docker and Podman drivers. On SELinux-enabled hosts (Fedora, RHEL), bind-mounted paths need relabelling so container processes can access them. This was missing from the bind mount support added in #1785.

Related Issue

Extends #1785

Changes

• Add shared SelinuxLabel enum (shared / private) to openshell-core::driver_mounts
• Docker driver: move user bind mounts from the structured Mount API (which lacks SELinux support) to the legacy string-format Binds field, appending :z or :Z when selinux_label is set
• Podman driver: add selinux_label to PodmanDriverMountConfig::Bind and push z/Z to the mount options vec
• Update docs/reference/sandbox-compute-drivers.mdx mount schema tables for both drivers

Testing

• cargo fmt --all -- --check passes
• cargo clippy --workspace passes
• Unit tests added/updated (5 new tests across Docker and Podman drivers)
• Manually tested with Podman on Fedora
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)