Document dns and mac_address validation behavior

What does this MR do?

Documents the behavior change introduced by !6902 (merged) (moby v29 Docker SDK migration): the dns and mac_address Docker executor settings are now validated before the job container is created, instead of being silently forwarded to Docker.

See #39588 (closed) for the full write-up of the change and the error messages users will see.

Why was this change needed?

Filed proactively so the docs are in place before !6902 (merged) ships, per the plan in issue 39588 (avoid the first report coming from a customer).