hcsoci,hcs,shim: honor CPU affinity for Argon containers

[zylxjtu]

Process-isolated (Argon) WCOW containers run inside a server silo, which is a job object owned by HCS. HCS does not expose a CPU-affinity field on the container Processor schema (Count/Maximum/Weight), so the OCI spec.Windows.Resources.CPU.Affinity field was silently ignored for Argon containers at both create and update time.

Honor it the same way HostProcess containers do: open the silo's job object (by its well-known \Container_ name, the same handle queryInProc already opens) and apply the affinity with SetInformationJobObject(JobObjectGroupInformationEx) via the existing SetCPUGroupAffinities helper.

Create path:

• Add (*hcs.System).SetSiloCPUGroupAffinities, which opens the silo job and sets the group affinities on it.
• After CreateComputeSystem but before the container is started, apply affinity for Argon (HostingSystem == nil) via applyArgonCPUAffinity. This is race-free: the kernel records the property on the job, then applies it to the init process (and every descendant that later joins the silo) at the moment HCS calls AssignProcessToJobObject during Start. No container instruction ever runs on a forbidden processor, and the property lives on the kernel object so no per-PID walking or watchdog is needed.

Update path (runtime update / UpdateContainerResources):

• Loosen isValidWindowsCPUResources to accept an affinity-only update (no Count/Shares/Maximum), so affinity can be changed after the container starts.
• updateWCOWContainerCPU now only sends the HCS Processor modify request when a rate control is set (avoiding an empty no-op request) and additionally applies affinity out of band when present.
• New updateWCOWContainerCPUAffinity re-pins the silo for Argon via the same SetSiloCPUGroupAffinities mechanism (the kernel re-applies the mask to current and future silo members). Hypervisor-isolated (Xenon) containers return ErrNotImplemented rather than silently dropping the request, since they require a UVM-level CPU-group swap.

Shared helpers:

• Collect the container-kind-agnostic CPU affinity validators (ValidateCPUAffinity / ValidateCPUAffinityEntries), their sentinel errors, and the OCI -> jobobject.GroupAffinity converter (ToJobObjectAffinities) into a single kind-neutral cpuaffinity.go, shared by the HostProcess (internal/jobcontainers) and Argon paths. jobcontainers now reuses ToJobObjectAffinities instead of a duplicated conversion loop.

Xenon (UVM-backed) containers are out of scope here and are skipped; they require UVM-level CPU groups and are handled separately.

Tests: unit coverage for the converter, the affinity validators, the loosened isValidWindowsCPUResources (including affinity-only), and the affinity-update dispatch (no-op and Xenon not-implemented branches). End-to-end silo pinning is now covered by a Windows functional test (Test_Container_CPUAffinity_Argon in test/functional/container_affinity_test.go): it creates a process-isolated container with spec.Windows.Resources.CPU.Affinity and asserts the affinity is written to the silo's job object in the create→start window (and again once a member is running), plus a kernel-level check that the init process was constrained to the pinned group — skipped if the affinity can't be read, but a genuine mismatch fails the test.. It covers the single-group case on any host plus a multi-group case gated on a Server 2022+ host with more than one processor group.

Signed-off-by: zylxjtu (zhang.yuanliang@hotmail.com)