Support idmap mounts in snapshotter to avoid expensive chown walk with user namespaces

### What is the version of your Accelerated Container Image

Latest release (issue applies to all current versions)

### What would you like to be added?

When `--uidmap`/`--gidmap` is passed to containerd, the snapshotter should handle ID mapping itself using Linux idmap mounts (`mount_setattr()` with `MOUNT_ATTR_IDMAP`) rather than relying on containerd's fallback chown walk.

Concretely, in `pkg/snapshot/overlay.go`, `Prepare()` should:

1. Check for `containerd.io/snapshot/uidmapping` and`containerd.io/snapshot/gidmapping` labels
2. After mounting the block device, call `open_tree()` with `OPEN_TREE_CLONE` to get a detached mount fd
3. Construct a user namespace fd from the mapping labels
4. Call `mount_setattr()` with `MOUNT_ATTR_IDMAP`
5. Attach via `move_mount()`
6. Advertise the idmap capability so containerd skips the chown walk

The kernel already supports idmap mounts on both ext4 and erofs (since 5.12).

### Why is this needed for Accelerated Container Image?

Without this, running containers with user namespaces triggers containerd's fallback: a full recursive lchown walk of the entire container rootfs mounted at a temporary path.

This is the same issue described in containerd/containerd#10313 (proxy plugins cannot advertise idmap capability), but the fix lives here in the snapshotter implementation. A similar [idmap impl was done for erofs ](https://github.com/containerd/containerd/pull/12433/changes).

Kernel 5.12+ supports idmap mounts on ext4; erofs is also supported.

### Are you willing to submit PRs to contribute to this feature?

- [x] Yes, I am willing to implement it.