* Add Dynamic Instrumentation system probe feature

Adds spec.features.dynamicInstrumentation.enabled to the DatadogAgent
CRD and a dyninst feature handler that turns it into the pod-spec
changes system-probe needs (HostPID, capabilities, procdir/cgroups/
debugfs/socket volumes, and the DD_DYNAMIC_INSTRUMENTATION_ENABLED /
DD_SYSTEM_PROBE_ENABLED env vars). Enabling the flag pulls in the
system-probe container automatically rather than requiring a separate
toggle.

This intentionally omits the node-scoped remote-config path and
per-node DatadogAgentProfile management from the earlier draft of this
work: Dynamic Instrumentation will only ever be enabled cluster-wide,
and services move between nodes too often for node-level targeting to
make sense. Delivery of the flag itself (remote, controlled rollout
with rollback) is handled by Fleet Automation's existing operator
experiment mechanism, which patches this same spec field directly, so
no bespoke remote-config wiring is needed here.

* Mount a writable state dir for the DI system-probe module

system-probe runs with a read-only root filesystem, and the dyninst
feature handler didn't mount anywhere for the Dynamic Instrumentation
module's own writable state (the debugger-probes tombstone file and
the SymDB upload cache), so the module had nowhere to write.

The path matters here: it needs to match run_path/system-probe/
dynamic-instrumentation, not /tmp/datadog-agent/system-probe/
dynamic-instrumentation, since datadog-agent#53286 just moved this
state out of /tmp for a security fix (world-writable /tmp was a
symlink-attack vector). Mounting at the old /tmp path would satisfy
nothing, since the module doesn't write there anymore.

Adds a dedicated emptyDir volume for this, mounted only on the
system-probe container, at a path derived from the same RunPathVolume
Mount constant logcollection already uses for its own run-path mount,
so it stays in sync if that base path ever changes.

Verified with go build, go vet, and go test across the datadogagent
and datadogagentinternal controller packages, including updating
dyninst's own feature test to expect the new volume/mount. Confirmed
none of the renderer golden-file fixtures needed updating, since none
of them enable dynamicInstrumentation (they only render its default
off value).

(cherry picked from commit eb07514)

Co-authored-by: grantseltzer <[email protected]>
Co-authored-by: Timothée Bavelier <[email protected]>