Only allow host-relative LDConfig paths

[elezar]

This change only allows host-relative LDConfig paths (i.e. the nvidia-container-cli.ldconfig setting starts with an @)

An allow-ldconfig-from-container feature flag is added to allow for this
the default behaviour to be changed.

This feature can be toggled by running:

sudo nvidia-ctk config --in-place --set features.allow-ldconfig-from-container=true

or by including allow-config-from-container in the NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES envvar.

[klueska]

1. Let's continue to allow host-relative path to ldconfig even without the override
2. Let's then change the override flag to be called allow-ldconfig-from-container

[cdesiniotis]

@elezar besides rebasing, are there any other changes planned for this PR?

Question -- is it possible to include a comment in the default NVIDIA Container Toolkit config file that gets installed at /etc/nvidia-container-runtime/config.toml which documents the new feature flag we are adding?

Requested changes made.

[elezar]

Question -- is it possible to include a comment in the default NVIDIA Container Toolkit config file that gets installed at /etc/nvidia-container-runtime/config.toml which documents the new feature flag we are adding?

The features are currently omitempty, meaning that if none of them are set we would not show them. I can look at adding a comment similar to the docstring to the ldconfig option though.

update I have looked at what is required to add a comment to the ldconfig option, and I don't think it's worth the additional overhead to ensure consistency.