tproxy: add implicit constraint on client version

[tgross]

The new transparent proxy feature already has an implicity constraint on the presence of the CNI plugin. But if the CNI plugin is installed on an older version of Nomad, this isn't sufficient to protect against placing tproxy workloads on clients that can't support it. Add a Nomad version constraint as well.

Fixes: #20614

[tgross]

Plan showing attempted deployment to a 1.7.6 client:

$ nomad job plan ./jobs/tproxy.nomad.hcl
+ Job: "countdash"
+ Task Group: "api" (1 create)
  + Task: "connect-proxy-count-api" (forces create)
  + Task: "web" (forces create)

+ Task Group: "dashboard" (1 create)
  + Task: "connect-proxy-count-dashboard" (forces create)
  + Task: "dashboard" (forces create)

Scheduler dry-run:
- WARNING: Failed to place all allocations.
  Task Group "api" (failed to place 1 allocation):
    * Class "multipass": 1 nodes excluded by filter
    * Constraint "${attr.nomad.version} semver >= 1.8.0-dev": 1 nodes excluded by filter

  Task Group "dashboard" (failed to place 1 allocation):
    * Class "multipass": 1 nodes excluded by filter
    * Constraint "${attr.nomad.version} semver >= 1.8.0-dev": 1 nodes excluded by filter

Job Modify Index: 0
To submit the job with version verification run:

nomad job run -check-index 0 ./jobs/tproxy.nomad.hcl

When running the job with the check-index flag, the job will only be run if the
job modify index given matches the server-side version. If the index has
changed, another user has modified the job and the plan's results are
potentially invalid.

Same job, after upgrading the client to this patch:

$ nomad job plan ./jobs/tproxy.nomad.hcl
+ Job: "countdash"
+ Task Group: "api" (1 create)
  + Task: "connect-proxy-count-api" (forces create)
  + Task: "web" (forces create)

+ Task Group: "dashboard" (1 create)
  + Task: "connect-proxy-count-dashboard" (forces create)
  + Task: "dashboard" (forces create)

Scheduler dry-run:
- All tasks successfully allocated.

Job Modify Index: 0
To submit the job with version verification run:

nomad job run -check-index 0 ./jobs/tproxy.nomad.hcl

When running the job with the check-index flag, the job will only be run if the
job modify index given matches the server-side version. If the index has
changed, another user has modified the job and the plan's results are
potentially invalid.