feat(vmm): support secure netd socket activation - #1069

Summary

• change self-bound netd sockets from world-writable to configurable socket_mode = 0o660
• accept exactly one systemd-activated Unix stream listener through LISTEN_FDS
• retain standalone socket binding as a fallback and keep SO_PEERCRED UID authorization
• document systemd socket/service units and the ownership boundary

The default is defined in vmm.toml; the Rust field does not add a second serde default.

Behavior

• standalone: netd binds [netd].socket and applies [netd].socket_mode
• socket activated: systemd owns socket mode/user/group and netd consumes fd 0
• zero activated descriptors falls back to standalone mode
• multiple descriptors or a non-Unix-stream descriptor fail closed

Testing

• cargo fmt --all -- --check
• cargo test -p dstack-vmm --no-fail-fast (124 passed)
• cargo clippy -p dstack-vmm --all-targets -- -D warnings