fix(worker): mount /dev/shm as tmpfs in the Docker v2 nsjail sandbox (#10240)

The Docker v2 nsjail profile provided /dev/null, /dev/zero, /dev/random,
and /dev/urandom but omitted /dev/shm, since generate_rootfs_mounts()
skips the image's own /dev in favor of the profile's device nodes. Any
program needing POSIX shared memory (Ansible/Python multiprocessing,
Chromium) failed with "No such file or directory: /dev/shm".

Add a /dev/shm tmpfs mount, matching run.ansible.config.proto and
run.python3.config.proto.

Fixes WIN-2216

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/windmill-worker/nsjail/run.docker.config.proto

@@ -77,6 +77,13 @@ mount {
     is_bind: true
 }
 
+mount {
+    dst: "/dev/shm"
+    fstype: "tmpfs"
+    rw: true
+    is_bind: false
+}
+
 # Host DNS config layered over the image's /etc so name resolution works on the
 # job's network (mandatory:false: some minimal images have no /etc files to shadow).
 mount {