Fix security review findings and release signing

[axellpadilla]

Summary

Fixes the release-blocking findings from a full code review, plus a broken release-CI signing step.

Security (release-blocking)

• Container-escape via HostConfig nesting. check_create_body inspected only the top JSON level, but the Docker daemon reads Privileged/CapAdd/SecurityOpt/Devices/PidMode/IpcMode/UsernsMode from the nested HostConfig, so {"HostConfig":{"Privileged":true}} passed. Now inspects both levels, plus DeviceRequests and NetworkMode: host; explicit false/empty/null no longer over-block.
• container-runtime profile cross-product. allow was a single RuleSet (method-AND-endpoint axes unioned), so its two grants merged into {GET,HEAD,POST,PUT,DELETE} × (readable ∪ runtime) — silently permitting DELETE /volumes/{id}, DELETE /networks/{id}, etc. allow is now a RuleList of independent rules.
• Body inspection keyed on the profile enum, not the effective policy — --profile none + allowlist, and the CONTAINERS=1 POST=1 shim, forwarded create bodies uninspected. Now triggered whenever the effective policy permits POST /containers/create.

Correctness

• Malformed request paths now return 400 (not 403).
• Streamed chunked over-limit bodies now return 413 (not 502).
• --log-level is no longer shadowed by an ambient RUST_LOG.
• Upgraded (101) connections are drained on graceful shutdown.
• 413s are counted/audited; binary response headers no longer dropped; Internal error body no longer leaks the variant prefix.

Release CI

• cosign sign-blob now writes a .sigstore.json bundle via --bundle (the deprecated --output-signature/--output-certificate flags are ignored under the current bundle format and made the step fail). .sigstore.json is what OpenSSF Scorecard's Signed-Releases check recognizes.

Verification

• cargo fmt --check clean; cargo clippy --all-targets --all-features/-no-default-features -- -D warnings clean.
• cargo test --all-targets passes 87 tests (both feature sets), including new integration tests for the 400 path and non-container-runtime body inspection.
• Fuzz targets compile against the new RuleList API.

The release workflow itself only runs on tag push / workflow_dispatch, so it isn't exercised by this PR's checks; the cosign change is based on the Sigstore docs (--bundle is the recommended flow).