Podman fix: derive `--userns=keep-id` mapping from the remote user's actual UID/GID

## The problem

When running a dev container with rootless podman, the Dev Containers CLI injects a plain `--userns=keep-id` flag, which maps the host user id to the *same UID number* inside the container.

This breaks for high/out-of-range host UIDs (e.g. AD/SSSD users which have values like`1400601154`, which are not valid inside the container (they are out of range as the containers are typically given a 0-65535 range via subuid/subgid mapping). As a result the mapping fails silently and the container's `vscode` user remains at UID 1000, not matching the host user, and causing `Permission denied` on the workspace bind mount).

## Current workaround

The current workaround is a fragile manual `runArgs` entry (`--userns=keep-id:uid=1000,gid=1000`). Since the host UID is unmappable to itself, we keep the 1000 id inside the container and map the host user to that. This allows one to use podman on Linux boxes with AD and thus high uid/gid combinations, as it removes the requirement for the exact host UID to be inside the container's range.

## The request for improvement

Instead of injecting a plain `--userns=keep-id`, the CLI should resolve the `remoteUser`'s actual UID/GID in the image and emit `--userns=keep-id:uid=,gid=`. This fixes the high-UID case with no regressions: when the host UID already equals the container user's UID, `keep-id:uid=X,gid=X` produces the identical mapping to plain `keep-id`, so existing setups are unaffected.

首先追踪 Dev Containers CLI 在哪里注入原始的 `--userns=keep-id` 参数，以及它如何解析镜像内的 `remoteUser`。针对较高的主机 UID/GID 以及主机和容器 ID 匹配的情况，验证生成的 Podman 参数，确保这两种情况下都保留预期的 workspace 权限。

由索引模型根据 Issue 内容生成。