Volume Mounts for Local Runs

Currently, runtime volumes defined in `func.yaml` are ignored when running functions locally with `func run`.

We should update `pkg/docker/runner.go` -> `newHostConfig()` to configure volumes in addition to the ports it currently defines.

1. **ConfigMap** → Local `.func/run/configmaps/` directory
2. **Secret** → Local `.func/run/secrets/` directory
3. **EmptyDir** → Docker tmpfs or anonymous volume
4. **PersistentVolumeClaim** → Named Docker volume or local directory

Additionally, we could consider adding a new volume type specifically for local development:
```yaml
volumes:
- hostPath: /local/path
path: /container/path
```

Implementation Notes:

There should be warnings when defined resources are note available locally, but not fail.

Should disallow mapping of directories outside of .func for security (example risk: user downloads a malicious function, runs it locally, accessing sensitive areas of the FS and exfiltrating via the funciton source implementation)

## Current Workarounds

1. Use the "host" builder (loses container isolation)
2. Run `func build` then manually `docker run -v local:container image`
3. Deploy to a test cluster for volume testing

Start in pkg/docker/runner.go at newHostConfig(), then trace how runtime volumes from func.yaml reach func run. Define how ConfigMap, Secret, EmptyDir, and PersistentVolumeClaim map locally, including warnings for unavailable resources and the .func path restriction; done means local runs apply supported mounts without failing on unavailable resources.

Written by the indexing model from the issue text.