Add nested virtualization support for wslc containers

**Is your feature request related to a problem? Please describe.**

Workloads that need `/dev/kvm` inside a wslc container (`qemu-kvm`, libvirt-managed VMs, Firecracker, Android emulators, and similar) cannot run today, because the wslc utility VM never asks the hypervisor for virtualization extensions.

`HcsVirtualMachine.cpp` builds the utility VM that hosts every wslc container, and sets `Processor.Count`, `EnablePerfmonPmu`, and `EnablePerfmonLbr`, but does not set `Processor.ExposeVirtualizationExtensions`. There is also no field in `WSLCSessionSettings` or `WSLCFeatureFlags` for a caller to ask for it. So even on a Windows 11 host where nested virt is otherwise straightforward, a wslc container's guest sees no `vmx` / `svm` flag and `/dev/kvm` is absent.

The equivalent opt-in already exists for WSL2 distros via `nestedVirtualization=true` in `.wslconfig`. See #40735 for a Windows 10 regression in that path.

**Describe the solution you'd like**

A new `WslcFeatureFlagsNestedVirtualization` bit in the existing `WSLCFeatureFlags` enum in `src/windows/service/inc/wslc.idl`, wired through `HcsVirtualMachine.cpp` to set `vmSettings.ComputeTopology.Processor.ExposeVirtualizationExtensions = true` when the flag is set. Callers of `IWSLCSessionManager::CreateSession` opt in via `WSLCSessionSettings::FeatureFlags`.

A draft of the service-side wiring is on [sirredbeard/WSL@win10-nested-virt-and-wslc](https://github.com/sirredbeard/WSL/tree/win10-nested-virt-and-wslc). It also includes the same Windows 10 perfmon guard from #40735, since Hyper-V on Windows 10 rejects partition creation when `ExposeVirtualizationExtensions` and `EnablePerfmonPmu` are both set.

**Describe alternatives you've considered**

- Enable virtualization extensions by default for every wslc utility VM. Too invasive. Nested virt costs memory and partition setup time, and most container workloads do not need it. Opt-in via feature flag matches the existing pattern for `WslcFeatureFlagsGPU` and `WslcFeatureFlagsVirtioFs`.
- A separate IDL field on `WSLCSessionSettings`. Would break the existing pattern for what is conceptually a feature toggle, and the `WSLCFeatureFlags` enum already exists for this.

**Additional context**

End-to-end testing on the wslc side will need a client surface (CLI flag or programmatic API) that sets the flag through to `CreateSession`. The draft branch only changes the service side. Happy to extend it if that would be useful.