feat: collect workspace logs in support bundles (#26694)

Add workspace-side file collection to `coder support bundle` via
repeatable --workspace-file flags. The agent resolves the requested
paths or globs inside the remote workspace and streams back a tar with
a manifest and the collected files; nothing is read from the machine
running the command.

- Add POST /api/v0/bundle-files to the agent's agentfiles package.
- Expand env vars in the agent's environment; paths must then be
  absolute or start with ~/ (the agent user's home directory).
- Support ** globs and tail oversized files.
- Record requested patterns, per-path errors, truncation, and the
  applied limits in a manifest.
- Unpack the archive into the bundle under agent/workspace_files/,
  recording dropped entries in collection_errors.txt.
- Write a manifest-only archive marking collection as unsupported for
  agents that predate the endpoint.
- Bound collection: 64 KB request body, 10000 files, 10 MiB per file,
  100 MiB total including archive overhead, 110 MiB client-side read
  cap, 5 minute timeout.

Closes #26020

cli/testdata/coder_support_bundle_--help.golden

@@ -28,6 +28,13 @@ OPTIONS:
           Override the URL to your Coder deployment. This may be useful, for
           example, if you need to troubleshoot a specific Coder replica.
 
+      --workspace-file string-array, $CODER_SUPPORT_BUNDLE_WORKSPACE_FILE
+          File path or glob to collect from inside the remote workspace.
+          Environment variables are expanded in the workspace; paths must then
+          be absolute or start with ~/, which resolves against the agent user's
+          home directory. Files local to the machine running this command are
+          not collected. Can be specified multiple times.
+
       --workspaces-total-cap int, $CODER_SUPPORT_BUNDLE_WORKSPACES_TOTAL_CAP
           Maximum number of workspaces to include in the support bundle. Set to
           0 or negative value to disable the cap. Defaults to 10.