kata-containers: upgrade to 3.32.kata0

[Redent0r]

Here we are:

• upgrading kata-containers to https://github.com/microsoft/kata-containers/releases/tag/3.32.0.kata0 (see for fork validation msft-preview: 3.32.0 rebase kata-containers#463 )
• Adapting spec file for runtime-rs build (source still leaves runtime-go as default)
• Adds a patch to enable build in current AZL rust v1.90. Tested locally and verified this patch can be dropped once we update to rust v1.94 (also what upstream uses)
• Adding a separate config for VM templating for runtime-go
• enabling kernel-mshv configs for VM templating
• Drop / adapt existing patches

Patches getting dropped:

• Patch0: CVE-2026-24054.patch : https://nvd.nist.gov/vuln/detail/cve-2026-24054 Up to (excluding)3.26.0
• Patch1: rust-1.90-fixes.patch : builds without errors in 3.32
• Patch2: CVE-2026-24834.patch : https://nvd.nist.gov/vuln/detail/CVE-2026-24834 Up to (excluding) 3.27.0
• Patch3: CVE-2026-25727.patch : https://nvd.nist.gov/vuln/detail/CVE-2026-25727 fixed on 3.27 Fix CVE 2026 25541 kata-containers/kata-containers#12475
• Patch4: CVE-2026-25541.patch : https://nvd.nist.gov/vuln/detail/CVE-2026-25541 affects "bytes" From version 1.2.1 to before 1.11.1. We currently use 1.11.1 https://github.com/microsoft/kata-containers/blob/saul/msft-preview/Cargo.lock#L905
• [KEEP] Patch5: CVE-2025-11065.patch: Affected: <= 2.3.0 . We use v1.5.0 (may be able to reuse patch)
• [KEEP] Patch6: CVE-2026-41602.patch : "The vulnerable code is a bundled snapshot of thrift inside go.opentelemetry.io/otel/exporters/jaeger v1.0.0 (2021), at internal/third_party/thrift/lib/go/thrift/framed_transport.go. That snapshot predates the Apr 2026 fix, and kata 3.32 still pins jaeger v1.0.0, so the fix is not there"
• Patch7: CVE-2026-39821.patch : Up to (excluding) golang:net 0.55.0 which was bumped in 3.32 kata-containers/kata-containers@c0f5498
• Patch8: CVE-2026-33814.patch: Up to (excluding) golang:http2 (net) 0.53.0 which was upgraded in 3.31 kata-containers/kata-containers@7cc72b933d
• Patch9: CVE-2025-58160.patch : Affects tracing-subscriber < 0.3.20. Fixed on 3.29 by agent: Bump tracing-subscriber kata-containers/kata-containers#12672
• Patch10: CVE-2026-27171.patch: Up to (excluding) zlib1.3.2. zlib is pulled by libz-sys. In 3.32, we use libz-sys 1.1.28 https://github.com/microsoft/kata-containers/blob/saul/msft-preview/Cargo.lock#L3937 . Libz-sys 1.1.28 pulls libz 1.3.2 rust-lang/libz-sys@b19d278

validation:

• bb: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1164332&view=results
• image build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1164403&view=results
• conformance: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1164471&view=results
  • with templating: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1163600&view=ms.vss-test-web.build-test-results-tab (expected failures related to usin shared_fs=none)
• performance: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1163613&view=results
  • with templating: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1165615&view=results (regressions with runc/Kata, but using uksouth instead of westeurope above, because of capacity issues)