fix: resolve dockerfile_template with secure=False during containerize

[Abhishek8108]

Summary

Fixes #5566.

bentoml containerize raised ValueError: Accessing file outside of current working directory is not allowed for any bento that uses dockerfile_template. This is a regression introduced in #5548.

Root cause: generate_containerfile called resolve_user_filepath(user_templates, build_ctx) with the default secure=True. The secure=True check verifies that the resolved path is relative to os.getcwd(). During bentoml containerize, build_ctx is a BentoML-managed temp directory (e.g. /tmp/...), which is never under the user's CWD — so the check fires as a false positive.

Fix: Pass secure=False when resolving the template path inside generate_containerfile. This is correct because:

• The template was already validated and copied into the bento archive by build_config.py during bentoml build (where secure=True is appropriate)
• At containerize time, build_ctx is a BentoML-controlled temp dir, not a user-supplied path
• The path being resolved is relative and scoped to build_ctx — there is no security concern

Change: One argument added to one call site in generate.py. Regression test added to test_generate.py that reproduces the failure before the fix and passes after.

Test plan

• New test test_generate_containerfile_dockerfile_template_outside_cwd passes (creates a template in tmp_path, which is outside CWD, and calls generate_containerfile — previously raised ValueError)
• Existing test test_generate_containerfile_quotes_system_packages still passes
• Run pytest tests/unit/_internal/container/test_generate.py -v