scheduler: fix r:value taint handling (INFRA-4010)

[cmlad]

Summary

• add the public and internal missing_or_contains_any placement operand for constraints and affinities
• validate the new operand and evaluate it in both string-backed node targets and typed device attributes
• temporarily evaluate legacy ${meta.t-r} affinities stored as set_contains_any with the corrected missing-or-contains-any behavior
• document the operand across the job specification and JSON jobs API, with a release note

Why

Nomad's constraint model cannot otherwise express is_not_set OR set_contains_any. Legacy r:value taint affinities therefore rejected nodes without ${meta.t-r}, even though missing metadata should be tolerated.

The compatibility behavior is applied only during scheduler affinity evaluation for the exact, case-sensitive ${meta.t-r} plus set_contains_any combination. It uses a local effective operand and does not mutate stored job or affinity data. Constraints, device affinities, other metadata keys, and other operands keep their existing behavior.

Validation

• go test ./... from api/ — pass
• go test -vet=off ./nomad/structs — pass
• go test ./scheduler -run 'Test(ConstraintChecker|CheckConstraint|CheckAttributeConstraint|NodeAffinityIterator|MatchesAffinity)' — pass
• git diff --check — pass
• go test ./scheduler — affected tests pass; the package remains red on unrelated existing spread/binpack expectation tests (TestSpread_ImplicitTargets, TestServiceSched_Spread, and TestServiceSched_JobRegister_SchedulerAlgorithm)
• go test ./nomad/structs — blocked by the existing vet error in nomad/structs/volumes.go:193; the package passes with vet disabled
• website lint/content checks were not run because website/node_modules is not installed

Follow-up

• after operators emit missing_or_contains_any and legacy jobs have been replaced, remove the exact ${meta.t-r} compatibility bridge and its legacy-only tests; retain the general operand