GPG / SSH agent forwarding into container

## Gap

Upstream \`@devcontainers/cli\` forwards the host's SSH agent socket and (optionally) GPG agent socket into the container by default, via mounts + env (\`SSH_AUTH_SOCK\`). We do not.

## Expected

- Default: bind-mount \`\$SSH_AUTH_SOCK\` (or platform equivalent) into the container and set \`SSH_AUTH_SOCK\` in remoteEnv. Skip cleanly when no agent socket exists.
- GPG: opt-in mirror of GnuPG agent socket, since it's more invasive.
- Both should be disable-able via \`EngineOptions\` for headless / hermetic consumers (DAP).

## Notes

Real-world consequence: \`git clone git@github.com:...\` inside a devcontainer fails under our runtime where it succeeds under the upstream CLI.