Add no-new-privileges process controls

[sturdy4days]

Closes #2161

Summary

• expose --no-new-privileges through process commands and persisted configuration;
• apply the effective setting monotonically across container init and container exec; and
• add parser, persistence, runtime, and CLI acceptance coverage.

Compatibility

noNewPrivileges defaults to false; older persisted configurations decode unchanged. Existing behavior is therefore unchanged unless the opt-in control is requested.

Validation

• make swift-fmt-check
• make build-tests
• focused ParserTest|ProcessConfigurationTests (142 tests)
• isolated TestCLIRunSecurityPaths (7 tests), including init/exec application and API monotonicity