feat: support compose image volumes

[papidb]

Support Compose long-syntax image volumes by translating them to the existing --mount=type=image implementation.

The Compose path now resolves image sources that reference active or disabled services, ensures missing mount-source images before the child command runs with --pull=never, and validates image-specific options before project resources are created. Image mounts remain read-only.

image.subpath was intentionally left alone until the lower-level support in #4993 is available.

Tests cover external and service-referenced sources, source pulling, read-only behavior, malformed definitions, mount-field injection, unchanged legacy volume arguments, and cleanup.

Related to #4767.

[AkihiroSuda]

CI failing for Docker
https://github.com/containerd/nerdctl/actions/runs/32843708128/job/97846811402?pr=5161

  compose_up_linux_test.go:1339: 
        
        +------------------------------------------------------------------------------------------------------------+
        | ➡️      | ⚙️ /usr/bin/docker compose -p testcomposeimagevolumeservicesource-image-service-source-99d59bae  |
        |         | -f /tmp/TestComposeImageVolumeServiceSource3467620079/001/b9c9a923/compose.yaml up -d            |
        +------------------------------------------------------------------------------------------------------------+
        |         | 🚫 command returned a non-zero exit code                                                         |
        +------------------------------------------------------------------------------------------------------------+
        |         | ⚠️ 1                                                                                             |
        +------------------------------------------------------------------------------------------------------------+
        |         | 🟠  Image source Pulling                                                                         |
        |         |  Image source Error pull access denied for source, repository does not exist or may require 'doc |
        |         | ker login'                                                                                       |
        |         | Error response from daemon: pull access denied for source, repository does not exist or may requ |
        |         | ire 'docker login'                                                                               |
        +------------------------------------------------------------------------------------------------------------+
        | 🌱      | (hidden: set TIGRON_DEBUG_ENV=1 to display)                                                      |
        +------------------------------------------------------------------------------------------------------------+
        | ⏰      | <1s (limit: 3m0s)                                                                                |
        +------------------------------------------------------------------------------------------------------------+
        | 📁      | /tmp/TestComposeImageVolumeServiceSource3467620079/002                                           |
        +------------------------------------------------------------------------------------------------------------+
        

[papidb]

Yeah, I'm on it. Thanks.

[papidb]

Hi @AkihiroSuda quick question about Compose image volumes.

The Compose spec defines source as an image reference. Docker Compose follows this, except when source matches a service that builds an image using Compose’s default - name, I will match that behavior.

Docker does not resolve a service’s explicit image: or a service disabled by a profile. It treats source literally and tries to pull it as an image.

Should nerdctl match Docker and the spec for these two cases, or intentionally support them as a nerdctl extension by resolving the service’s image?