Allow "safe" operations of CSI plugins

Currently CSI plugins are usually required to run as privileged to be able to mount stuff on the host. This (sadly) also requires one to allow "privileged" for all other containers on the node.

If it were possible that CSI plugins would implicitly add `privileged=true` (I think this should be possible; after all it also adds a bindmount to /csi which also would be denied by the default docker plugin configuration), then one would not have to allow `privileged=true` for all other jobs.

Now to prevent submission of all jobs as csi plugins one can use the namespace capability from https://learn.hashicorp.com/tutorials/nomad/access-control-policies?in=nomad/access-control#csi-register-plugin to limit this to certain users.

What do you think? All in all I think this would greatly improve the security of nomad when CSI plugins are in use.

No files, tests, or implementation entry points are named. Start by clarifying how CSI plugin registration should grant privileged access without affecting other jobs, then define tests showing that only authorized CSI plugins receive the capability and ordinary jobs remain restricted.

Written by the indexing model from the issue text.