Improve snapshot/oci validation

[ludfjig]

Just come misc improvements

[Copilot]

Pull request overview

This PR tightens validation when loading OCI snapshot layouts and snapshot config metadata in hyperlight_host, reducing the chance of accepting malformed images or unsafe artifact files.

Changes:

• Validate OCI index.json and manifest schemaVersion / mediaType more strictly during load, with clearer error text.
• Harden artifact file handling by rejecting non-regular files (e.g., FIFOs) when opening blobs.
• Strengthen snapshot config validation (pt_size presence/nonzero, entrypoint bounds within code region, stack alignment) and add/extend regression tests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/hyperlight_host/src/sandbox/snapshot/file/mod.rs	Adds OCI index/manifest schema and media-type validation and improves media-type error formatting.
src/hyperlight_host/src/sandbox/snapshot/file/fsutil.rs	Prevents opening non-regular blob paths (and avoids FIFO blocking on Unix) plus adds a FIFO rejection test.
src/hyperlight_host/src/sandbox/snapshot/file/config.rs	Makes snapshot layout validation stricter (required pt_size, code-region entrypoint bounds, alignment checks).
src/hyperlight_host/src/sandbox/snapshot/file_tests.rs	Adds regression tests covering the new validation behavior and edge cases.
CHANGELOG.md	Notes the user-visible behavior change: stricter snapshot/OCI validation and non-regular file rejection.