[OMEGA-407] Enable GPU passthrough support in Omega Docker image

[paul-v-snet]

Description

The reason the agent cannot access the GPU is that the Landlock filesystem policy does not include the required NVIDIA driver and device paths. As a result, the main agent process cannot access the GPU, and its child processes cannot access it either because they inherit the same Landlock restrictions.

To fix the issue, it is sufficient to add the required paths to policy.yaml and implement a mechanism for adding them dynamically. The set of required paths may differ depending on the system and configuration. At the same time, if a path specified in the policy does not exist on the current system, Landlock cannot apply the policy and returns an error.

Therefore, all potentially required NVIDIA paths were added to policy.yaml, but before applying the policy, the apply method collects only the NVIDIA driver and device paths that actually exist on the current system and applies the policy using that set.

This should support different GPU configurations, including multiple GPUs exposed to the Docker container, as well as different environments such as native Linux and WSL.

How Has This Been Tested?

• Reproduced on WSL2 with --device nvidia.com/gpu=all passed to the container. Before the fix, the agent's own nvidia-smi -L shell call returned Failed to initialize NVML: N/A, while a plain docker exec ... nvidia-smi -L on the same running container detected the GPU correctly.
• Verified the fix in live testing. After the fix, nvidia-smi -L invoked by the agent from inside the container worked correctly, the agent gained access to the GPUs and was able to use them successfully.

Checklist

• PR contains autogenerated code
• Self-review completed
• Test scenarios above are passed with the version of the code from PR