[ECS] [request]: Allow Privileged tasks to run on User Namespace enabled Container Instances

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

Enable the ECS-Agent to identify the container instances that have "userns" enabled on a docker daemon level and when a task is run, run that task with the "--userns=host" flag

**Which service(s) is this request for?**
ECS (Ec2 Launch Type)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

When you have Container instances with the User re mappings enabled, it is impossible to run privileged mode Tasks on those container instances as docker requires these containers to be run wiht the --userns=host flag.

If you run a Task on a User Remapped container instance, you get:

CannotCreateContainerError: Error response from daemon: privileged mode is incompatible with user namespaces. You must run the container in the host namespace when running privileged mode

**Are you currently working around this issue?**

The only way is to have the Container Instances that have either the User Remappings enabled or those who do not, tagged with Attributes and use Placement constraints.

Which is not entirely useful, as sometimes you need to run a mix of containers on the same instance (privileged mode containers and not privileged containers) but keeping security high on those containers that are not supposed to be privileged via user namespacing.

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

The request concerns the ECS-Agent, Docker daemon user namespaces, and privileged task launch; no files or tests are named. Start by locating the agent’s container-instance capability detection and privileged container creation paths. Done means user-namespace-enabled instances can run privileged tasks with the host user namespace while non-privileged containers retain user namespace isolation, with coverage for the reported Docker error case.

Written by the indexing model from the issue text.