overlay: support userxattr mount option for overlays in user namespaces

[insanitybit]

I'm experiencing a sentry panic when I enter a user namespace and then attempt to mount an overlay filesystem. This is fundamentally because gVisor does not support the userxattr mount option, instead hardcoding trusted.overlay prefix, leading to a permission mismatch between the init namespace and the user namespace.

When an overlay is mounted inside a user namespace, setting these xattrs fails with EPERM, causing the sentry panic:

unrecoverable overlayfs inconsistency: failed to make renamed directory opaque: operation not permitted 

This PR adds support for the userxattr mount option, which uses user.overlay.* xattrs instead of trusted.overlay.*. This appears to be very similar to the linked kernel commit that implements similar functionality except that the linked kernel commit is careful to disable redirect_dir and metacopy when userxattr is active but that isn't relevant here since gvisor does not support those currently.

Relevant kernel commit here, which I think is analagous.
"This is necessary for overlayfs to be able to be mounted in an unprivileged namepsace [sic]."

torvalds/linux@2d2f2d7

Discovered this while trying to set up some internal isolation within gVisor, I had AI produce a repro C file here:
#1636 (comment)

I don't really use Go so I did make use of Claude for this PR, though I tried to be careful in comparing it to the kernel commit.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.