oci/state: use crun's non-standard root state field to avoid bundle dir access

[henry118]

Partially fixes #648.

The OCI runtime spec defines what a runtime passes to hooks on stdin: a state JSON object containing a container's bundle path. To find the container root, the toolkit currently opens <bundle>/config.json and reads root.path from it. This requires read access to the bundle directory.

When Podman runs a container with --userns nomap or --userns auto, the invoking user's UID is intentionally excluded from the container's user namespace UID map. The hook process runs inside the container's user namespace with an unmapped UID, which has no permission to read the bundle directory owned by the host user. As a result, GetContainerRoot() fails opening config.json with permission denied, and every CDI hook that calls it exits with an error.

crun includes a non-standard root field in the state JSON it sends to hooks, populated from config.json's root.path:

https://github.com/containers/crun/blob/c3a49b822cc45c1ae9e0459eff534efe61c4a5be/src/libcrun/container.c#L746

This provides the rootfs path directly, without requiring any access to the bundle directory. GetContainerRoot() can now check s.Root first. If present, it can be returned directly without accessing the config JSON file.

This fix is limited to crun only. runc does not include a root field in its state JSON. And this fix requires crun ≥ 1.27 because 1.27 included a change which allows ignoring chdir permission errors before container hook is executed (containers/crun#2035).

Given #648 is reported on Podman and crun is podman's preferred and default runtime, this fix should be suffice for majority of the use cases.