fix(web-svc-collabora): add required Docker capabilities and resource limits for Collabora Jails

- Added security_opt (seccomp=unconfined, apparmor=unconfined) and cap_add (MKNOD, SYS_CHROOT, SETUID, SETGID, FOWNER)
  to allow Collabora's sandbox (coolmount/systemplate) to mount and chroot properly
- Increased resource limits (2 CPUs, 2 GB RAM, 2048 PIDs) to prevent document timeout and OOM issues
- Resolves 'coolmount: Operation not permitted' and systemplate performance warnings

Refs: https://chatgpt.com/share/68ed03cd-1afc-800f-904e-d1c1cb133914

roles/web-svc-collabora/config/main.yml

@@ -17,9 +17,13 @@ docker:
     database: 
       enabled: false
     collabora:
-      image:    collabora/code
-      version:  latest 
-      name:     collabora
+      image:            collabora/code
+      version:          latest
+      name:             collabora
+      cpus:             2
+      mem_reservation:  1g
+      mem_limit:        2g
+      pids_limit:       2048
 features:
   logout:   false 
   desktop:  true # Just set to allow the iframe to load it

roles/web-svc-collabora/templates/docker-compose.yml.j2

@@ -4,6 +4,15 @@
     {% include 'roles/docker-container/templates/base.yml.j2' %}
     image: "{{ COLLABORA_IMAGE }}:{{ COLLABORA_VERSION }}"
     container_name: {{ COLLABORA_CONTAINER }}
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
+    cap_add:
+      - MKNOD
+      - SYS_CHROOT
+      - SETUID
+      - SETGID
+      - FOWNER
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}"
 {% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}