Support SELinux: --security-opt label #4608

What is the problem you're trying to solve

Security flags:
🐳 --security-opt seccomp=<PROFILE_JSON_FILE>: specify custom seccomp profile
🐳 --security-opt apparmor=: specify custom AppArmor profile
🐳 --security-opt no-new-privileges: disallow privilege escalation, e.g., setuid and file capabilities
🐳 --security-opt systempaths=unconfined: Turn off confinement for system paths (masked paths, read-only paths) for the container
🐳 --security-opt writable-cgroups: making the cgroups writeable
🤓 --security-opt privileged-without-host-devices: Don't pass host devices to privileged containers

nerdctl has always lacked SELinux-related labels: similar to Docker's --security-opt label

Describe the solution you'd like

The function and fields are similar to: Docker's --security-opt label

Additional context

No response