Add dm-verity support for EROFS layers in containerd

This PR introduces block-level data integrity verification for EROFS container layers using device-mapper verity (dm-verity):

• Uses the veritysetup CLI tool to create Merkle hash trees and dm-verity devices for EROFS blobs.
• Adds new configuration: enable_dmverity = true for both snapshotter and differ plugins.
• EROFS layers are formatted with a dm-verity hash tree; metadata is stored in layer.erofs.dmverity alongside the blob.
• At runtime, each layer is mounted via a dm-verity device (read-only) and verified.
• Mount options for dm-verity are passed via the mount manager and applied per layer.
• Extensive tests cover formatting, mounting, idempotency, error cases, and end-to-end workflow.
• Non-Linux environments gracefully handle unsupported dm-verity operations.

Note: When enabled, it requires a Linux kernel with dm-verity support and the dm_verity module loaded, and the veritysetup binary from cryptsetup