Handle systempaths=unconfined security option

[Iriome-Santana]

Summary

Fix support for security_opt=["systempaths=unconfined"].

Docker CLI handles this option client-side by removing it from SecurityOpt and setting:

• MaskedPaths=[]
• ReadonlyPaths=[]

before sending the container configuration to the daemon.

docker-py currently forwards systempaths=unconfined directly to the daemon, which results in:

invalid --security-opt: "systempaths=unconfined"

This change mirrors the Docker CLI behavior by:

• removing systempaths=unconfined from SecurityOpt
• setting MaskedPaths to []
• setting ReadonlyPaths to []
• adding unit tests covering the behavior

Fixes #3377.