Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy
(third_party/containerization, upstream commit 6b7b42ca) referenced by path, so
we can carry a small local patch that upstream lacks: LinuxContainer.Configuration
gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream
already supports VMConfiguration.extensions + the VZInstanceExtension hook, but
LinuxContainer — our only entry point — never forwarded them, so there was no way
to attach a device (e.g. a memory balloon) to a container's VM.

Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed
for footprint (we never build the dependency's tests). See PATCHES.md for the full
diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras
product to NucleicCore (AddressAllocator, named in the configureVZ signature).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitignore

@@ -0,0 +1,28 @@
+.DS_Store
+bin
+libexec
+.build
+.local
+xcuserdata/
+DerivedData/
+.swiftpm/
+.netrc
+workdir/
+installer/
+.venv/
+test_results/
+*.pid
+*.log
+*.zip
+*.o
+*.ext4
+*.pkg
+*.swp
+*.tar.gz
+*.tar.xz
+vmlinux*
+
+# API docs for local preview only.
+_site/
+_serve/
+