Support KubernetesNodes talos.sysctls after upstream API acceptance #72

Upstream PR cozystack/cozystack#5254 proposes an optional KubernetesNodes.spec.talos.sysctls string map on main. It replaces the single-purpose talos.userNamespacesLimit proposal in cozystack/cozystack#4650, following cozystack/cozystack#4650 (comment). The earlier dedicated-field specification in this issue is superseded; neither PR is assumed merged or released.

Once the upstream API is accepted and available in a release, add an optional talos.sysctls map of strings to the KubernetesNodes resource and data source, preserve it through expand/flatten/import, and cover it with round-trip tests. Keep an unset or empty map omitted so Talos defaults continue to apply. The provider hand-maintains these schemas and mappings, so this is not supplied automatically by upstream generation.

Example: sysctls = { "user.max_user_namespaces" = "11255" } sets the guest-worker namespace limit needed by the Talos gVisor extension. String "0" is an explicit override, not omission; remove the entry to restore the default. Changing the map changes the upstream content-hashed bootstrap configuration and rolls the pool's workers. This does not install gVisor or change management-host/control-plane sysctls.

This remains a follow-up only. Do not implement the superseded user_namespaces_limit field or require an API dependency bump before the upstream map proposal is accepted.