Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (#945)

On modern systemd hosts using cgroups v2, /proc/1/cgroup reports PID 1 in "/init.scope" rather than "/". The previous heuristic treated any non-"/" cgroup path as "inside docker", so the auth-code callback server bound to 0.0.0.0 (all interfaces) instead of 127.0.0.1 loopback on ordinary Linux hosts, contrary to RFC 8252 section 8.3.

Detect only genuine container markers (/.dockerenv, /run/.containerenv, or docker/containerd/kubepods/lxc/libpod in the PID 1 cgroup path). Real Docker/Podman/Kubernetes containers are still detected, so the docker port-forwarding scenario is preserved. Adds unit tests for _is_inside_docker(). Part of #886.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>