Confidential Space image 261001 removes compromised CAs, adds non-root containers

A new Confidential Space image (261001) is available. This image removes compromised CA certificates from the OS trust store. See the security bulletin for more details.

This image also adds support for running workload containers as a non-root user. Workload authors can require non-root execution with the tee.launch_policy.nonroot_container launch policy, and workload operators can enable it with the tee-nonroot-container metadata variable. For more information, see Non-root container execution.