[CI]: Alma extended attributes getting lost (with nydus convert) (help needed)

### Description

`TestImageConvertNydusVerify` has been failing, for example:
https://github.com/containerd/nerdctl/actions/runs/15784646412/job/44498256000?pr=4327

It seems like converting the image with nydus does shed the extended attributes present in the original image.

This is happening solely on Alma (8&9).

Here is what is going on:
- start registry:2 and cesanta auth token
- `image convert --nydus --oci`
- `image tag`
- `image push`

Then:
`nydusify check --source ghcr.io/stargz-containers/alpine:3.13-org --target localhost:5001/nydusd-image:test --source-insecure --target-insecure`

Fails with:
```
validate filesystem failed: file not match in target image:\n\t[source] path: /usr/bin/bunzip2, size: 12, mode: 134218239, rdev: 0, symink: /bin/busybox, uid: 0, gid: 0, xattrs: map[security.selinux:[115 121 115 116 101 109 95 117 58 111 98 10 6 101 99 116 95 114 58 99 111 110 116 97 105 110 101 114 95 114 111 95 102 105 108 101 95 116 58 115 48 0]], hash: \n\t[target] path: /usr/bin/bunzip2, size: 12, mode: 134218239, rdev: 0, symink: /bin/busybox, uid: 0, gid: 0, xattrs: map[], hash:
```

### Steps to reproduce the issue

CI run `TestImageConvertNydusVerify`

### Describe the results you received and expected

Fail with missing ext attr on certain files.

### What version of nerdctl are you using?

main

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

_No response_