v1.4.3-dev-rke2-690.1

fix for image volumes under selinux

Pull in a fix for containerd/cri that pulls in a fix for
containerd/continuity: when copying directories for image volumes we
should filter out the security.selinux xattr key because the target has
been correctly relabeled already (and image volumes are copying from
layer storage which has a read-only selinux context).

- addresses rancher/rke2#690