chrony: render per-server time source configuration

[xiaotianlyu]

Description of changes:

Updates the chrony configuration template to support both forms of settings.ntp.time-servers.

The existing list form remains supported:

[settings.ntp]
time-servers = ["169.254.169.123", "time.aws.com"]
options = ["iburst"]

Each entry is rendered as a pool line with the shared options.

The new named form can configure each time source separately:

[settings.ntp.time-servers.link-local]
address = "169.254.169.123"
directive = "server"
options = ["prefer", "iburst", "minpoll 4", "maxpoll 4"]

This is rendered as:

server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4

This PR also:

• renders settings.ntp.logging as chrony log categories;
• creates /var/log/chrony for those logs;
• labels the directory for SELinux so chronyd can write to it.

The named settings model is added by the related settings-sdk PR. bottlerocket-os/bottlerocket-settings-sdk#146

Testing done:

Unit test:

cd sources && cargo test -p schnauzer --test chrony_conf_render

4 tests passed, covering:

• the existing list form with shared options;
• named servers with individual directives and options;
• missing optional fields and default directive behavior;
• entries with no address.

On-box testing with the complete three-PR change:

• built a local core-kit and an aws-k8s-1.32 x86_64 AMI;
• upgraded a Bottlerocket node from 1.64.0 to the test 1.65.0 image;
• verified /etc/chrony.conf contained the expected server and pool lines;
• verified chronyd was active with no restarts;
• verified measurements.log, statistics.log, and tracking.log were written under /var/log/chrony with the expected owner and measure_t SELinux label;
• rolled the node back to 1.64.0 successfully.

Related PRs:

• settings-sdk: feat: ntp: support per-server time source configuration bottlerocket-settings-sdk#146
• core-kit: chrony: render per-server time source configuration #1030
• bottlerocket: ntp: use per-server chrony settings bottlerocket#4923

This PR depends on a settings-sdk release containing PR #146. The Bottlerocket PR depends on a core-kit release containing this change.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.