feat(containers): export a service's declared git repo and branch on container_info

[PrashantBtkl]

What this PR does

A service can declare the repository and branch it runs, and container_info exports them as git_repo and git_branch. That lets the platform link a VM service (systemd unit or container) to its code without anyone typing it in. Only services that declare a repo gain the labels.

Decision: reuse the Kubernetes annotation keys as container labels (workloads.nudgebee.com/git.repo, .../git.branch) and read systemd's Environment= property for units, rather than parsing unit files. Only http(s) URLs are exported, with embedded credentials, query and fragment stripped, so a token in a URL can't become a metric label.

Look at: containers/git_source.go (the URL cleaning is the part with risk). The rest is wiring.

Linked issue / context

Lets the Nudgebee platform link a VM service to its code. The platform side reads these labels in a follow-up.

How was this tested?

• Unit tests for label and env parsing, credential stripping, and systemd-over-label precedence; whole containers package passes (built in the repo's bullseye toolchain, -Wl,-z,lazy).
• To verify on a host: add Environment=NUDGEBEE_GIT_REPO=https://github.com/org/api to a unit drop-in, restart it, then curl -s localhost:80/metrics | grep 'container_info.*git_repo'; or run a container with --label workloads.nudgebee.com/git.repo=https://github.com/org/api.

eBPF changes?

No.

Checklist

• make lint passes (gofmt, go vet)
• make test passes for ./containers
• CHANGELOG.md updated under ## [Unreleased]
• No real credentials, internal hostnames, or production captures in test fixtures

Engineering detail

• Docs: docs/service-git-source.md.
• Not read: systemd EnvironmentFile=; the running commit (a label holds a static repo/branch, not what is deployed).
• Adding labels to an existing metric changes its label set only for services that declare a repo; others emit the same series as before.

[gemini-code-assist]

Code Review

This pull request introduces the ability to track a service's source repository and branch via container labels or systemd environment variables, exposing this information through the container_info Prometheus metric. The reviewer correctly identified a potential issue with URL cleaning where trailing query indicators might persist, and pointed out that the documentation incorrectly claims existing metric series remain unchanged, when in fact adding new labels to a Prometheus metric descriptor will alter existing series. Both comments provide actionable feedback and should be addressed.