security(container-host-isolation): add docker security config

[hellomypastor]

Summary

• Add security hardening knobs for Docker sandboxes (cap drop, no-new-privileges, seccomp, AppArmor, PID limit, optional read-only rootfs) and
  propagate them into container creation.
• Document recommended secure defaults (EN/zh) and update example config for a strict baseline.
• Add a unit test to ensure security options are injected into host config.
• Fixes security-enhanced for docker impl service #16

Testing

• Not run (explain why) — pytest not installed in env (No module named pytest)
• Unit tests
• Integration tests
• e2e / manual verification

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[Pangjiping]

LGTM