Add an image volume source to ActorTemplate

[ronlv10]

Follow-up to #553.

Summary

Add a volume source that mounts an OCI image's filesystem read-only into an actor, the same way Kubernetes does with image volumes.

This lets content be delivered into an actor without rebuilding the container image it runs.

API sketch

A third variant in the existing VolumeSource:

volumes:
  - name: platform-bin
    image:
      reference: registry.example/shim@sha256:...
      pullPolicy: IfNotPresent

containers:
  - name: workload
    image: user-image@sha256:...
    command: ["/opt/platform/bin/shim"]
    volumeMounts:
      - name: platform-bin
        mountPath: /opt/platform/bin

Semantics follow the Kubernetes image volume: the referenced image's filesystem is mounted read-only at a single directory, resolved at actor start/resume.

[ronlv10]

Julian Gutierrez Oschmann (@juli4n) feel free to assign to me