runtime: Add annotation-based block device mounting

[antoine-gaillard]

Problem: CSI block mode PVCs are passed as raw device nodes. Containers must mount them manually, requiring privileged: true or CAP_SYS_ADMIN. Additionally, new volumes without a snapshot (e.g. fresh EBS) arrive unformatted, and the guest rootfs doesn't ship mkfs/blkid.

Solution: New annotation instructs kata-agent to mount the device:

annotations:
  io.katacontainers.volume.block-mounts: '{"/dev/xvda": {"mount": "/data", "fstype": "ext4"}}'

How it works:

1. Block device hotplugged via existing volumeDevices path
2. Runtime checks host-side device with blkid — if unformatted, runs mkfs.<fstype> on the host before passing to the agent
3. Runtime parses annotation → creates grpc.Storage objects
4. Device removed from OCI spec (no raw device in container)
5. Bind mount added → container sees mounted filesystem

Options:

- mount: destination path (required)
- fstype: ext4, xfs (default: ext4)
- options: mount options (default: ["rw"])
- fsGroup: optional gid for ownership

Testing:

- 27 unit tests (parsing, validation, storage creation, host-side formatting)
- Live tested on cluster with CSI block PVC + fresh unformatted EBS and EBS with existing data

[zaymat]

overall lgtm. The logic to check we're not mount devices outside of what's defined in the pod spec seems ok.

Small nit on optimization.

Now let's do the Rust part 😁

[zaymat]

small optimization: if you instead go through container's devices and check if you found an entry for dev.ContainerPath in the blockMounts map, you go through each device once.

With the current option, you have a (# device)*(# auto mount) complexity.