Add update-labels command backed by a LabelUpdater driver interface

What does this MR do?

Adds a docker-machine update-labels --label key=value <machine> command, backed by a new optional LabelUpdater driver interface. The google driver implements it: labels are merged into the instance's current label set via SetLabels with the current fingerprint. Drivers that don't implement the interface report label updates as unsupported.

Why is this MR needed?

GitLab's runner managers need to refresh a liveness label (runner_manager_heartbeat) on the instances they track, so external cleanup can tell orphaned VMs from tracked ones. Age-based cleanup doesn't work for docker+machine fleets because machine reuse (MaxBuilds) stretches legitimate lifetimes to days. Design and incident context: gitlab-com/gl-infra/production-engineering#29652 (closed)

The runner-side counterpart that calls this periodically: gitlab-org/gitlab-runner!7264 (merged)

What's the best way to test this MR?

Unit tests cover the command (label parsing, unsupported driver, missing labels). Validated against real GCE via the runner sandbox: labels appear on the instance, existing labels survive the merge, and repeated updates refresh the value. Concurrent label writers race on the fingerprint; the loser's next update repairs it.