Add `podman.workDirMountFlags` option to set explicit mount flags for workDir

New feature

Please allow to set mount flags specifically for the working directory, such as :Z, to solve SElinux issues automatically.

Use case

I currently have an SElinux issue when I try to use the podman executor.
Effectively, podman generates the following mount options:

podman run [...] \
 -v /scratch/incoming/:/scratch/incoming/ \
 -v /s/data/stewardship/GRZ_QC_Workflow/bin:/s/data/stewardship/GRZ_QC_Workflow/bin \
 -w /scratch/incoming/<id>/qc/work/58/ad01b84c38eee85faddf6dbd7e95bf \
[...]

I cannot set :Z option on every volume mount as I am not the owner of these folders.

Suggested implementation

While other directories might be read-only, the working directory will always be owned (or at least sufficiently writable) by the executing user.
Therefore, it is a safe assumption that one can always set the :Z mount flag on the working directory.

Could we have an explicit podman.workDirMountFlags option that is set to Z by default?

The issue does not name files or tests; start by locating the Podman executor's work-directory mount generation and the existing executor option definitions. Confirm the new option applies only to the working-directory mount, defaults to Z, and add or update coverage for the resulting mount flags.