service: add 'docker service exec' command

[dlarochette]

What I did

Added a docker service exec subcommand that executes a command in a running task of a service, on whichever node the task is currently scheduled — without having to manually resolve the node and container and SSH into it.

This addresses the long-standing request in moby/moby#27552 (open since 2016), at the CLI level: since the engine API has no cross-node exec and swarmkit has no exec RPC, the CLI reuses its own existing SSH connection helper (the DOCKER_HOST=ssh:// mechanism, docker system dial-stdio on the remote side) to reach the engine of the node running the task.

How I did it

• Resolve the service, list its tasks filtered on desired-state=running, and pick the first running task — or the one given with --task-id.
• If the task runs on the node the client is already connected to (compared via Info().Swarm.NodeID), perform a plain local exec.
• Otherwise, inspect the node, build an ssh:// host from its advertised address (Status.Addr, falling back to the hostname), open a second API client through connhelper.GetConnectionHelperWithSSHOpts, and run the exec through it.
• In both cases the existing container.RunExec plumbing is reused as-is, so -i, -t, detach keys, console resize, and exit-code propagation behave exactly like a local docker exec.
• --ssh-user and --ssh-option allow adjusting the SSH connection (jump hosts, identity files), with the same semantics as DOCKER_HOST=ssh:// connections.

Requirements for the remote path (documented in the reference page): SSH access to the node and the docker CLI in the remote user's PATH with access to the local engine socket — the same requirements as DOCKER_HOST=ssh://.

How to verify it

Unit tests cover task selection (default, explicit, not-running, missing) and node address resolution:

go test ./cli/command/service/ -run 'TestPickTask|TestNodeSSHHost' -v

Verified manually on a 2-node swarm, local and remote paths:

$ docker service exec web-remote sh -c 'hostname; echo remote-exec-works'
executing on node node2 (uwrn9hfgx65c95wd4tcek3xiy)
4984efe363e7
remote-exec-works

$ echo hello-stdin | docker service exec -i web-remote sh -c 'cat; echo got-it'
hello-stdin
got-it

$ docker service exec web-remote sh -c 'exit 43'; echo $?
43

$ docker service exec -it web-remote sh -c 'tty'   # under a real terminal
/dev/pts/0

A note on the approach

I'm aware a fully native cross-node exec would live in swarmkit (a bidirectional sibling of the LogBroker) and the engine API; that's a much larger, 3-repo effort. This PR takes the pragmatic route with the transport the CLI already owns and documents its requirements explicitly. Happy to adjust the UX (flag names, error wording) or discuss whether this belongs behind an experimental gate.

Description for the changelog

Add `docker service exec` command to execute a command in a running task of a service, reaching the node through SSH when the task runs on another node.