host-ctr: Unmask /sys/firmware from host containers

[jpculp]

Description of changes:

This provides extra insight into the hardware of the underlying Bottlerocket host, such as the number of CPU sockets on aarch64 variants.

NOTE: List of masked paths come's from containerd's oci/spec.go.

Testing done:

Built and launched an aarch64 k8s variant on a c6g.large and ran lscpu from the control container.

Architecture:           aarch64
  CPU op-mode(s):       32-bit, 64-bit
  Byte Order:           Little Endian
CPU(s):                 2
  On-line CPU(s) list:  0,1
Vendor ID:              ARM
  Model name:           Neoverse-N1
    Model:              1
    Thread(s) per core: 1
    Core(s) per socket: 2
    Socket(s):          1
    Stepping:           r3p1
    BogoMIPS:           243.75
    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid
                         asimdrdm lrcpc dcpop asimddp ssbs

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[jpculp]

Added the reference for masked paths into the code.

[bcressey]

nit: a permalink to the exact MaskedPaths list would be preferable, in case that list gets refactored out of the file

[jpculp]

Pinned the comment to the commit the masked paths were based on.