Drop MKNOD from microVM worker capabilities #3590

workerMicroVMCapabilities in cmd/atecontroller/internal/controllers/workerpool_apply.go grants the microVM worker MKNOD to preserve guest device-node creation when guest processes call mknod on the virtio-fs share.

Following PR #3580, containers can no longer add MKNOD, so guest containers cannot create device nodes. In addition, guest volume mounts and the virtio-fs share itself are mounted with nodev. This leaves the worker's CAP_MKNOD grant without an active workload requirement. Removing it would eliminate CAP_MKNOD from the bounding set of the host process serving guest filesystem requests.

Items to verify before removing:

• FIFOs and Sockets: Creation of S_IFIFO and S_IFSOCK via mknodat does not require CAP_MKNOD on Linux. Add e2e assertions to confirm these continue to work.
• Overlay Whiteouts: Deletion of lower-layer files uses overlayfs 0:0 character device whiteouts. Since Linux 5.8, creating these whiteouts in user namespaces does not require CAP_MKNOD (as already relied upon by the gVisor worker).
• Guest Agents: Confirm neither kata-agent nor guest bootstrap processes create device nodes directly on the share.
• Test Expectations: Update virtiofsdChildCapabilities and microVMWorkerCapabilities in internal/e2e/suites/demo/worker_security_filesystem_test.go.

Raised by Eitan Yarmush (@EItanya) in PR #3580.