Add dx_shm_size and dx_ipc_mode WDL runtime hints

[bomquangia]

Summary

• Adds two new opt-in WDL runtime hints: dx_shm_size and dx_ipc_mode
• These map to --shm-size and --ipc flags in the generated docker run command
• Both hints are optional; existing behavior is unchanged when neither is set
• Values are validated against strict allowlists to prevent shell injection
• Flags are emitted as quoted direct argv tokens (not via shell-expanded variables) for defense-in-depth

Usage

WDL 1.x (runtime block):

runtime {
  docker: "my-image:latest"
  dx_instance_type: "mem2_ssd2_gpu4_v2_x96"
  dx_shm_size: "8g"
  dx_ipc_mode: "host"
}

WDL 2.0 (hints block):

hints {
  dnanexus: {
    shm_size: "8g"
    ipc_mode: "host"
  }
}

Both values are WDL expressions and can be overridden per-invocation via overrides___ job inputs.

Changes

• core/src/main/scala/dx/core/languages/wdl/Runtime.scala — ShmSize/IpcMode DxRuntimeHints, validation, accessors
• executorWdl/src/main/scala/dx/executor/wdl/WdlTaskExecutor.scala — threads hints into generator.apply(...)
• core/src/test/scala/dx/core/languages/wdl/RuntimeHintsTest.scala — 11 new tests
• doc/ExpertOptions.md — user-facing documentation
• RELEASE_NOTES.md — changelog entry
• build.sbt — bumps wdlTools dependency to 0.17.18

Dependencies

Requires wdlTools 0.17.18 to be released before this PR's CI will pass dependency resolution.

Test plan

• wdlTools 0.17.18 released and available in GitHub Packages
• CI passes on this branch
• Manually verify generated containerRunScript contains --shm-size / --ipc when hints are set