Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy
(third_party/containerization, upstream commit 6b7b42ca) referenced by path, so
we can carry a small local patch that upstream lacks: LinuxContainer.Configuration
gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream
already supports VMConfiguration.extensions + the VZInstanceExtension hook, but
LinuxContainer — our only entry point — never forwarded them, so there was no way
to attach a device (e.g. a memory balloon) to a container's VM.

Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed
for footprint (we never build the dependency's tests). See PATCHES.md for the full
diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras
product to NucleicCore (AddressAllocator, named in the configureVZ signature).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Sources/ContainerizationArchive/CArchive/include/archive_bridge.h

@@ -0,0 +1,12 @@
+//
+
+#pragma once
+
+#include "archive.h"
+#include <stdint.h>
+
+void archive_set_error_wrapper(struct archive *a, int error_number, const char *error_string);
+
+/// Decompress a zstd-compressed file at \p src_fd into \p dst_fd.
+/// Returns 0 on success, or a non-zero error code on failure.
+int zstd_decompress_fd(int src_fd, int dst_fd);