landlock: Add counted_by in landlock_domain

For a domain, this array stores the access masks for each layer (of
which there are num_layers of them).  This annotation serves as useful
documentation.

Signed-off-by: Tingmao Wang <m@maowtm.org>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260208235449.1124354-1-m@maowtm.org
[mic: Rebase on the ruleset/domain split, and update commit message]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

security/landlock/domain.h

@@ -243,7 +243,8 @@ struct landlock_domain {
 			 * overlapping access rights.  These layers are set once
 			 * and never changed for the lifetime of the domain.
 			 */
-			struct access_masks handled_masks[];
+			struct access_masks
+				handled_masks[] __counted_by(num_layers);
 		};
 	};
 };