Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy
(third_party/containerization, upstream commit 6b7b42ca) referenced by path, so
we can carry a small local patch that upstream lacks: LinuxContainer.Configuration
gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream
already supports VMConfiguration.extensions + the VZInstanceExtension hook, but
LinuxContainer — our only entry point — never forwarded them, so there was no way
to attach a device (e.g. a memory balloon) to a container's VM.

Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed
for footprint (we never build the dependency's tests). See PATCHES.md for the full
diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras
product to NucleicCore (AddressAllocator, named in the configureVZ signature).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

kernel/image/Dockerfile

@@ -0,0 +1,30 @@
+FROM ubuntu:focal
+
+RUN apt-get update && apt-get install -y \
+    autoconf \
+    bc \
+    binutils-multiarch \
+    binutils-aarch64-linux-gnu \
+    binutils-x86-64-linux-gnu \
+    bison \
+    flex \
+    gcc \
+    xz-utils \
+    gcc-aarch64-linux-gnu \
+    gcc-x86-64-linux-gnu \
+    git \
+    libncurses-dev \
+    make \
+    openssl \
+    python-is-python3 \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/*
+
+COPY sources.list /etc/apt/sources.list
+
+RUN apt-get update \
+&&  dpkg --add-architecture arm64 \
+&&  dpkg --add-architecture amd64 \
+&&  apt-get install -y libelf-dev:arm64 libelf-dev:amd64 \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/*