variants: add aws-ecs-3* variants

[koooosh]

Issue number:

bottlerocket-os/bottlerocket-core-kit#712

Description of changes:

Add aws-ecs-3, aws-ecs-3-nvidia, aws-ecs-3-fips, aws-ecs-3-nvidia-fips variants.

Main differences from aws-ecs-2 include:

• kernel-6.12
• containerd-2.1
• systemd-257
• nftables
• whippet
• docker-engine/cli-29
• gp3 device volumes + IMDS v2
• EROFS
• Image verification feature
• Encrypted storage feature
• New NVIDIA R580 drivers for nvidia variants

Testing done:

• Relevant ECS conformance tests pass for all variants
• Nvidia smoke task succeeds for aws-ecs-3-nvidia

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[koooosh]

^ Rebasing so we can see a clean diff with the upcoming important revisions

[koooosh]

Force push makes the following changes:

• Add new aws-ecs-3-nvidia-fips variant
• Add image_verifier_plugins to aws-ecs-3 settings-plugins
• Add new default setting image-verification.toml and add symlinks to it for aws-ecs-3 and aws-ecs-3-nvidia defaults
• For each new ecs-3 variant:
  • Add encrypted-storage = true feature
  • Add aws-signer-notation-plugin and notation-image-verifier pkgs

[koooosh]

Force push adds commit changing the ecs-3 variant amispecs from symlinks (to the shared file) to an actual file with a preview description. Verification:

$ aws ec2 describe-images --image-ids ami-0f1e46ba690f5bfd8   --query 'Images[0].Description' --output text

This variant is in preview. It contains the newly released Docker v29.0.0 along with features related to image verification and encrypted storage.

[koooosh]

Force push address minor comments:

• Fixes plugins struct name to AwsEcs3Settings
• Changes numbering of default symlinks to 55-image-verification.toml to prevent conflict with 54-docker-pki:

ls -la 55-image-verification.toml
lrwxrwxrwx. 1 ec2-user ec2-user 48 Nov 13 14:15 55-image-verification.toml -> ../../../shared-defaults/image-verification.toml

[koooosh]

Force push updates docs + rebases to pick up core-kit bump for CI

[koooosh]

Final rebase ^