[Request]: expose no-new-privileges in process commands

### Feature or enhancement request details

Please expose a no-new-privileges process control in `container`. The lower-layer OCI/runtime support already exists; the CLI and persisted configuration do not currently make it available to container users.

The proposed scope is deliberately backward compatible:

- persist a `noNewPrivileges` process setting through CLI and configuration;
- enforce it monotonically for both container init and `container exec`, so an init setting cannot be weakened by an exec request;
- retain a `false` default and decode older configurations without change; and
- cover parser, process-configuration, and init/exec acceptance paths.

This would provide a narrow, opt-in control without changing existing default behavior.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by tracing the container CLI and persisted configuration into process configuration, then inspect the existing lower-layer OCI/runtime support. Check the parser and init/exec acceptance paths; done means the setting persists, defaults to false for older configurations, cannot be weakened for exec, and the requested paths are covered.

Written by the indexing model from the issue text.