Honour the active Docker CLI context for the default client

[ebriney]

Summary

Testcontainers picks a Docker daemon by walking a chain of provider strategies, but until now the chain did not look at the user's active Docker CLI context. On a machine where Docker Desktop ships the daemon at ~/.docker/run/docker.sock and currentContext in ~/.docker/config.json points at desktop-linux, the existing strategies still happen to work because DockerDesktopClientProviderStrategy hard-codes that path. But anyone who switches context — to OrbStack, a remote tcp:// host, an SSH endpoint, etc. — ends up driving a different daemon from the rest of their toolchain.

This PR adds a new SPI-registered strategy that mirrors docker(1)'s own resolution:

1. DOCKER_HOST env var (handled by the existing env-var strategy).
2. DOCKER_CONTEXT env var.
3. currentContext in $DOCKER_CONFIG/config.json (default ~/.docker/config.json).
4. Built-in default context (no metadata file — strategy steps aside and lets the local-socket strategies handle it).

For named contexts, the endpoint host is read from $DOCKER_CONFIG/contexts/meta/<sha256(name)>/meta.json, and per-context TLS material under contexts/tls/<sha256(name)>/docker/ is wired into a LocalDirectorySSLConfig when present.

What's in the change

• DockerContextResolver — pure utility that does the path math and JSON parsing. Public API is just two static methods plus a DockerContextEndpoint value object. Env-var lookup is parameterised so it can be tested without touching the process environment.
• DockerContextClientProviderStrategy — the SPI hook. Priority is EnvironmentAndSystemPropertyClientProviderStrategy.PRIORITY - 10, i.e. between the env-var strategy (100) and the unix-socket strategy (80), so DOCKER_HOST still wins as it does in the CLI. isApplicable() returns false for the built-in default context and for unsupported schemes (e.g. ssh://), letting the chain fall through cleanly.
• A second public constructor, DockerContextClientProviderStrategy(String contextName), lets callers pin a specific context by name, bypassing the auto-resolution.
• SPI registration in META-INF/services/...DockerClientProviderStrategy between the env-var and unix-socket strategies.

Tests

• DockerContextResolverTest — 11 unit tests over a temp config dir covering the resolution chain (env precedence, blank values, missing config), endpoint parsing, TLS discovery, malformed inputs, and a sanity check that the SHA-256 directory name matches what Docker Desktop actually writes for desktop-linux.
• DockerContextClientProviderStrategyTest — 9 tests covering isApplicable() for default/ssh/named contexts, the explicit-name constructor, missing-socket diagnostics, TLS wiring, priority bounds, plus two live tests that exercise an actual Docker daemon end-to-end (one via the strategy, one through DockerClientFactory.isUsing(...)). Live tests use assumeThat to skip cleanly when no daemon is reachable.
• Fixtures use forward-slash unix:// paths on POSIX and npipe:// on Windows so JSON parsing stays portable.

Docs

Updates docs/supported_docker_environment/index.md (discovery chain) and docs/features/configuration.md (DOCKER_CONTEXT and DOCKER_CONFIG env vars).

Test plan

• ./gradlew :testcontainers:test --tests "org.testcontainers.dockerclient.DockerContext*" passes on macOS with Docker Desktop running (live tests execute).
• Same on macOS with Docker Desktop stopped (live tests skip rather than fail).
• ./gradlew :testcontainers:checkstyleMain :testcontainers:checkstyleTest :testcontainers:spotlessApply is clean.
• CI runs on Linux / Windows.