fix(pmm-fb): install sudo on the sep-mysql target node (#1446)

## Summary

Install `sudo` on the `sep-mysql` target node.

`oraclelinux:9` ships no `sudo`, but ATW prepends it on its own:

- **14 of the 89 builtin snippets declare `sudo: always`** and prepend
it
  unconditionally, whatever the operator does.
- The other **65 declare `sudo: optional`** and prepend it as soon as
the
  "Run with sudo" switch is on.

So on the current harness those executions die at exec with:

```
env: 'sudo': No such file or directory
```

The failure is actively misleading. It reads as a privilege problem, but
`raw_exec` already runs its tasks as **root** on this node — nothing is
being
escalated. The missing binary is the whole fault, and the only visible
symptom
is a `Failed` execution with an empty stdout, so the cause has to be dug
out of
stderr.

That leaves a sixth of the shipped snippet library unrunnable on the one
node in
the harness that exists to execute snippets against a real database.

Scope is harness-only: one package added to the existing `dnf install`
line in
`sidecar/pmm-fb/Containerfile.mysql`. Nothing in the side-car or the
shipped
image changes.

## Tested

On the harness at `perconalab/pmm-server-fb:PR-4500-d85ca73` with a
side-car
built from `main` (06cfa01), executing on the `sep-mysql` Nomad node:

1. **Reproduced.** `node_io_cpu_memory_load_utilization_check.sh`
(`sudo: always`) dispatched to `sep-mysql` → **Failed**, empty stdout,
stderr
   `env: 'sudo': No such file or directory`.
2. **Confirmed the fix addresses it.** Installed `sudo` into the running
container and re-ran the same batch → **Done**, with the expected I/O /
CPU /
   load / memory output captured. A second snippet in the same batch
   (`mysql_too_many_connections_check.sh`) was unaffected either way.
3. **Built this branch's image.** `docker build -f Containerfile.mysql`
completed
green, and `command -v sudo && sudo -n true` inside the resulting image
   returns `/usr/bin/sudo` and succeeds non-interactively.

## Checklist

- [ ] New/modified functions have type hints and rST docstrings
- [ ] New tests added for new features or bug fixes
- [ ] All tests pass locally (`make test`)
- [x] Pre-commit hooks pass (`make run-pre-commit`)
- [ ] Database migrations generated if models changed (`make
makemigrations`)
- [ ] User-facing changes documented (README, inline help, UI text)
- [ ] Configuration changes documented with examples
- [x] Changelog fragment added under `changelog.d/` if the change is
user-facing (`make changelog-add`), or confirmed N/A (internal-only
change, or a same-release-cycle fix for an unreleased sibling ticket)

N/A items above: no Python touched (Containerfile only), so no type
hints,
docstrings, tests or migrations apply. No changelog fragment — internal
tooling,
per `changelog.d/README.md` skip case 1. The "why" is documented as a
comment on
the `dnf install` line itself, where a reader of the package list will
need it.

## Applying it

The image is built, so an existing harness needs a rebuild:

```bash
docker compose --profile mysql up -d --build
```

Author: yyyyyyyan

sidecar/pmm-fb/Containerfile.mysql

@@ -24,11 +24,16 @@ RUN rpm --import 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x79EA15
 # python3-PyMySQL mirror the ansible playbook's set. zstd, lz4, gnupg2 and rsync
 # are named though they already arrive transitively, so a shift upstream cannot
 # quietly drop a compression, encryption or upload option the forms offer.
+# sudo is not in the base image, but a builtin snippet declaring `sudo: always`
+# prepends it regardless, as does any snippet once "Run with sudo" is on.
+# Without the binary those die on `env: 'sudo': No such file or directory`
+# rather than on a privilege they already hold — raw_exec runs tasks as root
+# on this node.
 RUN dnf install -y \
         percona-server-server percona-toolkit python3-PyMySQL \
         percona-xtrabackup-84 mydumper \
         python3-pip gzip tar hostname procps-ng iproute \
-        zstd lz4 gnupg2 rsync \
+        zstd lz4 gnupg2 rsync sudo \
     && dnf clean all
 
 # Static Go binaries, so the feature build's own tree runs unchanged on OL9