Add nonroot-devices flag to agent CLI

[brandond]

Proposed Changes

Add new flag that is passed through to the device_ownership_from_security_context parameter in the containerd CRI config. This is not possible to change without providing a complete custom containerd.toml template so we should add a flag for it.

Types of Changes

enhancement

Verification

• Set flag, verify that param is set in containerd config.
• Verify that feature documented upstream at https://kubernetes.io/blog/2021/11/09/non-root-containers-and-devices/#see-non-root-containers-using-devices-after-the-fix works when this param is set.

Testing

Linked Issues

• Allow setting containerd device_ownership_from_security_context from config #11168

User-Facing Change

`device_ownership_from_security_context` can now be enabled in the containerd CRI config by setting the `--nonroot-devices` flag or config key.

Further Comments

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 42.14%. Comparing base (a39e191) to head (c6fa868).
Report is 7 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11200      +/-   ##
==========================================
- Coverage   47.06%   42.14%   -4.93%     
==========================================
  Files         179      179              
  Lines       18569    18572       +3     
==========================================
- Hits         8740     7827     -913     
- Misses       8474     9539    +1065     
+ Partials     1355     1206     -149     

Flag	Coverage Δ
e2etests	33.97% <100.00%> (-8.25%)	⬇️
inttests	34.70% <100.00%> (-0.01%)	⬇️
unittests	13.60% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.