[feature] Add chroot mapping to task config

# Description

The `exec` driver gets it's chroot directories from either the [default list](https://www.nomadproject.io/docs/drivers/exec.html) or the list specified in the [nomad client config](https://www.nomadproject.io/docs/agent/config.html#chroot_env).

For additional flexibility, it would be nice if we could specify the chroot mapping in the driver config of the job spec as well. The job spec chroot would have to be a subset of the nomad client chroot otherwise the driver will return an error.

Currently we're constrained to a single chroot mapping in the nomad client config that has to be appropriate for all types of jobs we want to run.
# Example

nomad client config

```
client {
chroot_env {
"/bin/ls" = "/bin/ls"
"/etc/ld.so.cache" = "/etc/ld.so.cache"
"/etc/ld.so.conf" = "/etc/ld.so.conf"
"/etc/ld.so.conf.d" = "/etc/ld.so.conf.d"
"/lib" = "/lib"
"/lib64" = "/lib64"
}
}
```

valid job spec chroot

```
task "example" {
driver = "exec"

config {
command = "/bin/sleep"
args = ["1"]

chroot_env {
"/bin/ls" = "/bin/ls"
"/lib/libiptc.so.0" = "/lib/libiptc.so.0"
}
}
}
```

invalid job spec chroot (`/etc/sysctl.conf` is not whitlisted in nomad client chroot)

```
task "example" {
driver = "exec"

config {
command = "/bin/sleep"
args = ["1"]

chroot_env {
"/bin/ls" = "/bin/ls"
"/etc/sysctl.conf" = "/etc/sysctl.conf"
}
}
}
```

Start by reading the exec driver and the task job-spec configuration handling, then compare them with the Nomad client chroot_env configuration. Done means accepting a job-level mapping only when it is a subset of the client mapping, and returning an error for entries outside that allowlist; validate both examples from the issue.

Written by the indexing model from the issue text.