test(contest): add update pids limit integration test

[moz-sec]

Description

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test updates
• CI/CD related changes
• Other (please describe):

Testing

• Added new unit tests
• Added new integration tests
• Ran existing test suite
• Tested manually (please provide steps)

Related Issues

Imprement #3576

Additional Context

As noted in #3594, the test for --update pids-limit fails, so skipped it.

I have confirmed that the test passes in runc.

$ just validate-contest-runc update
sudo RUNTIME_KIND="runc" /home/user/youki/scripts/contest.sh runc update
/usr/sbin/runc
# Start group update
1 / 2 : update_cgroup_v2_common_limits_test : ok
2 / 2 : update_pids_limit_test : ok
# End group update

This integration test was created based on the following description in updates.bats.
https://github.com/opencontainers/runc/blob/da3d022b06dd96a898f6d0cc1df2773df91ea035/tests/integration/update.bats#L330-L359

[moz-sec]

@saku3
Sorry.
The update test is failing during parallel execution due to duplicate cgroup names.
Also, it appears that some of these changes overlap with the changes in #3592.
Therefore, would it be okay to wait until this PR is merged and then modify the program to match that implementation?

[moz-sec]

@saku3
It looks like #3592 has been merged into main, so I merged it and then extracted it into pids_limit.rs.
Please review it.

[saku3]

Thank you for the PR.

I left one comment. Please take a look when you have a chance.

[saku3]

Could we explain why pids-limit 0 maps to pids.max = 1?

It seems to follow runc’s behavior, but the reason is not obvious from the current comment.

[moz-sec]

Set pids.max = 0 in a cgroup, new processes will no longer be created, causing the container to fail to start.
For this reason, runc converts the value of --pids-limit to 1 if it is 0.
This test is designed to match that behavior of runc.

I added this explanation as a comment in pids_limit.rs.

[saku3]

Thanks!