add definite limit for username mappings

[Mashimiao]

Signed-off-by: Ma Shimiao [email protected]

[vbatts]

I suppose this is fine. Any assumptions on providing that mapping would be left to the runtime implementation, so the MUST here makes sense.
LGTM

[wking]

There's related discussion in #961, where I point out that I'm fine punting this to runtime errors. But if we want to require runtimes to validate this on their own (instead of letting the kernel validate it), that's ok with me too.

[wking]

Should “generate an error” be a link, like we generally use now:

$ git describe
v1.0.1-20-g4ad8e74
$ git grep 'generate an error]' config-linux.md
config-linux.md:    The runtime MUST [generate an error](runtime.md#errors) if `path` is not associated with a namespace of type `type`.
config-linux.md:If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST [generate an error](runtime.md#errors).
config-linux.md:    If a [file][] already exists at `path` that does not match the requested device, the runtime MUST generate an error.
config-linux.md:Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case.
config-linux.md:    If no mounted `resctrl` pseudo-filesystem is available in the [runtime mount namespace](glossary.md#runtime-namespace), the runtime MUST [generate an error](runtime.md#errors).

[wking]

I'm also ok rewording this to be a config limitation, with something like:

Configurations that set an ID mapping MUST have entry in linux.namespaces where type is user and path is unset.

That way runtimes can punt to the kernel, but folks who want to pre-check their config with runtime-tools (or other) validation can catch instances of this.

[vbatts]

house keeping: hrm. This is another conditional MUST, but it is a behavior I think is consistent with how runc and pals currently does. So rev'ing the spec version ought not be needed.
@opencontainers/runtime-spec-maintainers is this sufficient to add just this sentence? (i think it should be fine)