feat: allow passing gcloud ADC credentials into local custom-action / verify containers via runArgs volume mount

## Problem

When running `skaffold exec` (custom actions) or `skaffold verify` locally, containers run in an isolated Docker environment with no access to the host's Google credentials. This means any container that needs to call a Google Cloud API via [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials) will fail with an authentication error — even if the developer has valid credentials on the host (`gcloud auth application-default login`).

In contrast, when the same pipeline runs in **Cloud Deploy**, the execution environment already runs as a specified Google Service Account and ADC works out of the box. This creates a local/remote parity gap: pipelines that call Google APIs (BigQuery, Cloud SQL, Vertex AI, etc.) cannot be tested locally with `skaffold exec` / `skaffold verify`.

### Reproduction

A typical verify test or custom action that calls a Google API:

```yaml
verify:
- name: bq-query-test
executionMode:
local: {}
container:
name: bq-test
image: google/cloud-sdk:slim
command: ["bq"]
args: ["query", "--nouse_legacy_sql", "SELECT 1"]
```

Running `skaffold verify` locally produces:

```
[bq-test] ERROR: (gcloud.auth.application-default.print-access-token)
[bq-test] Could not automatically determine credentials.
```

## Proposed solution

Expose a `runArgs` whitelist on `executionMode.local` (for both `customActions` and `verify`) that accepts a conservative set of `docker run` flags. The user can then bind-mount their local ADC credentials directory into the container to replicate what Cloud Deploy provides automatically:

```yaml
customActions:
- name: reuse-local-adc
executionMode:
local:
runArgs:
- "-v=/root/.config/gcloud:/root/.config/gcloud:ro"
- "--network=host"
containers:
- name: gcloud
image: google/cloud-sdk:slim
command: ["gcloud"]
args: ["auth", "list"]
```

This also works for `skaffold verify`:

```yaml
verify:
- name: bq-query-test
executionMode:
local:
runArgs:
- "-v=${HOME}/.config/gcloud:/root/.config/gcloud:ro"
container:
name: bq-test
image: google/cloud-sdk:slim
command: ["bq"]
args: ["query", "--nouse_legacy_sql", "SELECT 1"]
```

The whitelist is intentionally small (`--network`, `-v`/`--volume`, `--add-host`, `--tmpfs`) — only flags that map to the Docker `HostConfig` and have clear, bounded blast radius.

## References

- PR #10066 implements this feature (`feat: local runArgs whitelist for custom actions and verify`)
- Cloud Deploy managed execution environment: https://cloud.google.com/deploy/docs/execution-environment

Start by reviewing PR #10066 and the local execution paths for custom actions and verify. Confirm that the proposed runArgs whitelist supports the listed Docker flags and that the provided ADC volume-mount examples work for both skaffold exec and skaffold verify.

Written by the indexing model from the issue text.