Add --masked-path and --read-only-path to container machine create

[adityabagchi24]

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

Fixes: #2077

container run/container create already support --masked-path and --read-only-path (PR #2069) to hide or protect sensitive paths inside a container. Container machines did not expose the same controls, so users had no way to mask or protect paths inside a machine's backing container.

This PR adds --masked-path and --read-only-path to container machine create. The paths are persisted in the machine's MachineConfiguration (create-time only, matching how the machine's platform is fixed) and applied to the backing container at boot. When not specified, the runtime OCI defaults apply; the NONE sentinel clears the defaults as it does for container run/create. The effective paths are surfaced in container machine inspect under maskedPaths and readonlyPaths.

MachineConfiguration uses decodeIfPresent/encodeIfPresent with explicit CodingKeys so existing machines from earlier revisions still decode, and new machines are readable by older revisions.

[jglogan]

@adityabagchi24 Thank you for the contribution. #2069 was merged prior to the creation of the issue, so we're going to close this one. Apologies for the confusion!