jobcontainers: wire Windows CPU affinity to JobObject limits

[wenyang]

Summary

• Wire OCI Windows CPU affinity into JobContainer limits translation (specToLimits).
• Extend JobLimits with CPUAffinity and apply it in SetResourceLimits via SetCPUAffinity.
• Add unit tests for affinity translation and resource-limit application.

Motivation

This is the Phase 1 quick-win for Windows CPU affinity: unblock HostProcess pod scenarios that run through the JobContainer/JobObject path.

Scope

• Files changed:
  • internal/jobcontainers/oci.go
  • internal/jobcontainers/oci_test.go
  • internal/jobobject/jobobject.go
  • internal/jobobject/limits.go
  • internal/jobobject/jobobject_test.go

Behavior

• If windows.resources.cpu.affinity is specified as a single entry with group=0 and non-zero mask, affinity is applied to the job object.
• Existing behavior is unchanged when affinity is not specified.

Limitations (intentional for Phase 1)

• Multiple affinity entries are rejected.
• Non-zero processor groups are rejected.
• HCS silo container Processor schema affinity support is not part of this PR (Phase 2).

Testing

• Added tests:
  • TestSpecToLimits_CPUAffinity_Group0MaskSet
  • TestSpecToLimits_CPUAffinity_MultiGroupRejected
  • TestSpecToLimits_CPUAffinity_NonZeroGroupRejected
  • TestSpecToLimits_CPUAffinity_ZeroMaskRejected
  • TestSetResourceLimitsCPUAffinity
• Validation command used:
  • GOOS=windows go test ./internal/jobcontainers ./internal/jobobject -count=1 -v