allow to patch containerd CRI base OCI spec

[smira]

From containerd config:

      # base_runtime_spec is a file path to a JSON file with the OCI spec that will be used as the base spec that all
      # container's are created from.
      # Use containerd's `ctr oci spec > /etc/containerd/cri-base.json` to output initial spec file.
      # Spec files are loaded at launch, so containerd daemon must be restarted on any changes to refresh default specs.
      # Still running containers and restarted containers will still be using the original spec from which that container was created.
      base_runtime_spec = ""

Idea: Talos generates base OCI spec, and merge machine configuration patches supplied by the user, building a final base OCI spec which will be used by the CRI.

This allows e.g. to change default ulimits for containers, or in general any OCI settings which are not configurable in Kubernetes.