Backport of exec: allow running commands from host volume into release/1.4.x

[hc-github-team-nomad-core]

Backport

This PR is auto-generated from #14851 to be assessed for backporting due to the inclusion of the label backport/1.4.x.

The below text is copied from the body of the original PR.

---

Fixes #11781

The exec driver and other drivers derived from the shared executor check the path of the command before handing off to libcontainer to ensure that the command doesn't escape the sandbox. But we don't check any host volume mounts, which should be safe to use as a source for executables if we're letting the user mount them to the container in the first place.

Check the mount config to verify the executable lives in the mount's host path, but then return an absolute path within the mount's task path so that we can hand that off to libcontainer to run.

Includes a good bit of refactoring here because the anchoring of the final task path has different code paths for inside the task dir vs inside a mount. But I've fleshed out the test coverage of this a good bit to ensure we haven't created any regressions in the process.

---

Longer-term with some sort of exec v2 I'd like to switch all of this to an overlay FS, but we'll need a new FSIsolation mode so as not to break any 3rd-party drivers relying on the existing alloc dir behavior.

Example jobspec that this enables, assuming a binary named hello at the host volume named shared_data:

job "example" {
  datacenters = ["dc1"]

  group "hello" {

    volume "host_data" {
      type      = "host"
      read_only = false
      source    = "shared_data"
    }

    task "hello" {

      driver = "exec"

      config {
        command = "/host_data/hello"
      }

      volume_mount {
        volume      = "host_data"
        destination = "/host_data"
        read_only   = true
      }

    }
  }
}

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.