fs: add unstable io_uring uring_cmd support for File

[SidongYang]

Implements File::uring_cmd using UringCmd16 with io_uring runtime/cancellation integration and tests.

Refs #7897

[SidongYang]

@martin-g Thanks for the review! I've updated the PR and squashed the changes into a single commit.

Here are the updates based on your feedback and some self-review:

• unsafe & Safety docs: Marked uring_cmd as unsafe and added a # Safety section, as it allows arbitrary payload submission which can lead to use-after-free or memory corruption.
• Realistic Example: Added an # Examples section in the docs that demonstrates how to safely pack a #[repr(C)] struct into the 16-byte payload.
• API Documentation: Explicitly added Builder::enable_io to the required features in the docstring.
• Unit Test Improvements: Extracted the dummy payload into local variables, wrapped the call in unsafe, and added a specific assertion to check for std::io::ErrorKind::Unsupported (since a standard file without a uring_cmd implementation returns -EOPNOTSUPP).
• Locking Refactor (Self-review): Simplified the inner locking logic (complete_inflight) to be more idiomatic and match the style used in try_clone().
• Concurrency: Regarding your question about whether it's OK to start other File ops while uring_cmd16() is still executing: Yes, it is! The operation creates an independent OwnedFd via self.std.try_clone(), so it won't block the inner state of the Tokio file descriptor for subsequent operations.

Let me know if there's anything else that needs adjusting!