Support disabling automatic "rslave" fallback

While containerd and CRI-O consistently maps PROPAGATION_PRIVATE (CRI) to rprivate (OCI),
cri-dockerd (dockerd) conditionally maps it to either rprivate or rslave:

https://github.com/Mirantis/cri-dockerd/blob/6daf9ac0f630da59ac1ab6f2af8293793609f22e/libdocker/helpers.go#L234-L253

cri-dockerd should have an option to disable falling back to rslave, without sacrificing backward compatibility.

• Plan A: Introduce a custom Pod annotation like cri-dockerd.mirantis.com/deterministic-propagation=true.

• Plan B: Add a new constant like PROPAGATION_LITERALLY_PRIVATE to the CRI API.
  In the YAML it would look like mountPropagation: LiterallyNone.

• Plan C: Just return an error when recursivelyReadOnly == Required && propagation == None aka private && sourceContainsDaemonRoot. recursiveReadOnly is proposed in https://github.com/kubernetes/enhancements/pull/3858

Plan B probably needs going through the full KEP process, which may take several years.
So, my preference is Plan A or C.

Start with libdocker/helpers.go at the linked propagation-mapping code and review how cri-dockerd handles PROPAGATION_PRIVATE. Compare the proposed annotation and error approaches, including the recursive-read-only case, before choosing an implementation path. Done means users can disable the rslave fallback while existing behavior remains compatible.