wslc: containers can't use AF_VSOCK — seccomp blocks socket(AF_VSOCK) with no --security-opt/--privileged escape hatch

Nobody has claimed this yet.

### Summary
In WSL Containers (WSLC) public preview, a process inside a container cannot create an `AF_VSOCK` socket — `socket(AF_VSOCK, SOCK_STREAM, 0)` fails with `EPERM`. This blocks host↔container communication over Hyper-V sockets. There is no `wslc run`/`create` flag (`--privileged`, `--security-opt`, `--cap-add`, `--device`) nor any `settings.yaml` option to relax the seccomp/security policy, so there is currently no supported workaround.

### Repro
```dockerfile
# Dockerfile
FROM ubuntu:22.04
COPY vsock_server /vsock_server # any program that calls socket(AF_VSOCK, SOCK_STREAM, 0) + bind/listen
ENTRYPOINT ["/vsock_server"]
```
```powershell
wslc build -t vsock-test .
wslc run --name v vsock-test
# -> socket error: Operation not permitted (EPERM on socket(AF_VSOCK))
```

### Actual vs. expected
- **Actual:** `socket(AF_VSOCK, …)` returns `EPERM`; the container cannot open a vsock socket at all.
- **Expected:** a supported way to permit `AF_VSOCK` (e.g. `--security-opt seccomp=unconfined`, a configurable seccomp profile, or `--privileged`), consistent with Docker.

### This is a policy block, not an architecture limit
- The container runs on the **shared WSL2 kernel** (`wslc run --rm ubuntu:22.04 uname -r` → `6.18.40.1-microsoft-standard-WSL2`), which fully supports `AF_VSOCK` (it works fine from a normal WSL distro on the same kernel).
- The failure is **`EPERM`, not `EAFNOSUPPORT`** → the family is supported but *denied by policy* (seccomp/LSM), i.e. the default container profile filters `AF_VSOCK`.

### What's missing
`wslc run`, `wslc create`, `wslc system`, and `settings.yaml` expose **no** security/seccomp/capability/privileged/device controls, so there is no way to allowlist `AF_VSOCK`.

### Request
Add a Docker-compatible escape hatch — one or more of:
- `--security-opt seccomp=`
- `--privileged`
- allowlist `AF_VSOCK` in the default seccomp profile (or a documented opt-in)

so containers can use Hyper-V sockets for host↔guest IPC.

### Related
- #41181 (Privileged container for fuse mount)
- #41031 (USB device passthrough for WSLC)

### Environment
- WSL **2.9.9.0** (pre-release), kernel **6.18.40.1-microsoft-standard-WSL2**
- Windows **10.0.26220.9223**
- `wslc` **2.9.9.0**

Start with the wslc run/create/system commands and settings.yaml mentioned in the issue, and reproduce the Dockerfile case using socket(AF_VSOCK, SOCK_STREAM, 0). Trace how the container security policy is selected and determine a supported configuration path; done means an AF_VSOCK container can run through a documented escape hatch or allowlist.

Written by the indexing model from the issue text.