gomodjail: update to v2.0.1, enforce static analysis in CI - #5192

gomodjail v2 moves the focus from the dynamic (seccomp) mode to a static
analysis gate: `gomodjail analyze` fails if a module annotated
`gomodjail:confined` in go.mod can reach a denied capability (filesystem,
network, process execution, raw syscalls, OS state modification, or cgo).

- Dockerfile: bump GOMODJAIL_VERSION to v2.0.1. `gomodjail pack`
  is unchanged in v2, so the packed `nerdctl.gomodjail` binary (dynamic
  mode) keeps working as before.
- Makefile: add `lint-gomodjail` / `lint-gomodjail-all` (part of
  `make lint`) and `fix-gomodjail` (part of `make fix`), and install
  gomodjail in `install-dev-tools`. The gate is only enforced for
  linux/amd64 and linux/arm64: these are the only platforms the packed
  binary is built for, and the only ones the dynamic mode supports.
  The verdicts are platform-dependent, hence both architectures are
  analyzed.
- CI: add the `gomodjail` job to the lint workflow.
- go.mod: `gomodjail fix` downgraded the annotation of the 39 modules
  that fail the gate to `gomodjail:unconfined`, so that the decision
  stays visible and reviewable. 57 modules remain confined
  (24 ok, 33 warnings, 0 violations). The inline annotations are also
  reformatted to `// gomodjail:...`, the style `gomodjail fix` writes,
  so that future fixes do not leave go.mod in two styles.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>