dockerfile: update runc to 1.2.5

[austinvazquez]

This is the fifth patch release in the 1.2.z series of runc. It primarily fixes an issue caused by an upstream systemd bug.

• There was a regression in systemd v230 which made the way we define device rule restrictions require a systemctl daemon-reload for our transient units. This caused issues for workloads using NVIDIA GPUs. Workaround the upstream regression by re-arranging how the unit properties are defined.
• Dependency github.com/cyphar/filepath-securejoin is updated to v0.4.1, to allow projects that vendor runc to bump it as well.
• CI: fixed criu-dev compilation.
• Dependency golang.org/x/net is updated to 0.33.0.

diff: opencontainers/[email protected]

[thaJeztah]

LGTM

test failure

[crazy-max]

https://github.com/moby/buildkit/actions/runs/13322251713/job/37392787599?pr=5741

Rootless integration seems to time out with runc 1.2.5 https://github.com/moby/buildkit/actions/runs/13322251713/job/37392787599?pr=5741 (whole test suite takes around 7 minutes usually)

Looks to be on TestClientGatewayIntegration/TestClientGatewayContainerHostNetworkingValidation/worker=containerd-rootless/netmode=host: https://github.com/moby/buildkit/actions/runs/13322251713/job/37392787599?pr=5741#step:8:1201.

[crazy-max]

Rootless integration seems to time out with runc 1.2.5 https://github.com/moby/buildkit/actions/runs/13322251713/job/37392787599?pr=5741 (whole test suite takes around 7 minutes usually)

Looks to be on TestClientGatewayContainerHostNetworkingValidation: https://github.com/moby/buildkit/actions/runs/13322251713/job/37392787599?pr=5741#step:8:1201.

Looks good after re-run of the job but we should keep an eye on it.