plugincontainer: Support mlock

[tomhjp]

When Vault's disable_mlock config setting is not set, it also tells plugins to call unix.Mlockall to ensure they don't swap any memory (with potentially sensitive data) out to disk. Without the IPC_LOCK capability, this is not possible inside a container, and previously meant containerized plugins would fail to start. hashicorp/vault#23215 is a WIP PR with the consumption of the new Config.CapIPCLock option.

To ensure better test coverage, I formalised the options we are interested in into a TestCompatibilityMatrix test. Some tests are skipped as they are known not to work, and some are skipped as TODO items, waiting to set up CI so they can pass. I'll be working to remove most/all of these skips over the coming weeks.

Also fixes a couple of small bugs and tidy-ups:

• Config's Tag field was not correctly set, found in one of the new tests
• The error message for a plugin that needs updating reported one of the wrong directories
• Refactors most of the tests into an external plugincontainer_test package so they are forced to use the library like an external consumer (Vault) would.
• A couple of errors are made more descriptive.

[swenson]

Looks mostly good. One question in the main().

I appreciate all of the automated tests, as it is a pain to get all of the combinations working on my own Linux desktop :)

[swenson]

LGTM

[tomhjp]

Thanks!