CNI_PATH not set on rootless setup

[frafra]

Description

Networking does not work after a standard rootless setup, because the bridge executable is not found.

Workaround (assuming that nerdctl-full has been unpacked under .local/bin):

export CNI_PATH=$HOME/.local/bin/libexec/cni

Steps to reproduce the issue

1. cd $HOME/.local/bin
2. curl -L https://github.com/containerd/nerdctl/releases/download/v1.7.2/nerdctl-full-1.7.2-linux-amd64.tar.gz | tar xz
3. containerd-rootless-setuptool.sh install
4. nerdctl run -it --rm alpine

Describe the results you received and expected

nerdctl run -it --rm alpine
FATA[0000] failed to verify networking settings: failed to create default network: needs CNI plugin "bridge" to be installed in CNI_PATH ("/opt/cni/bin"), see https://github.com/containernetworking/plugins/releases: exec: "/opt/cni/bin/bridge": stat /opt/cni/bin/bridge: no such file or directory 

What version of nerdctl are you using?

1.7.2

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

Client:
 Namespace:	default
 Debug Mode:	false

Server:
 Server Version: 1.6.26
 Storage Driver: overlayfs
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Log: fluentd journald json-file syslog
  Storage: native overlayfs
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
  rootless
 Kernel Version: 5.15.0-91-generic
 Operating System: Ubuntu 22.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 62.79GiB
 Name: linuxbox
 ID: 1575fb66-3b37-4cee-874c-1a7ce862ed01

WARNING: AppArmor profile "nerdctl-default" is not loaded.
         Use 'sudo nerdctl apparmor load' if you prefer to use AppArmor with rootless mode.
         This warning is negligible if you do not intend to use AppArmor.
WARNING: No cpu cfs period support
WARNING: No cpu cfs quota support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

[AkihiroSuda]

export CNI_PATH=$HOME/.local/bin/libexec/cni

This path looks weird.
The bridge binary should be located in $HOME/.local/libexec/cni.

nerdctl/docs/faq.md

Lines 214 to 222 in bcb5163

	The default value is automatically detected by checking the following candidates:
	- `~/.local/libexec/cni`
	- `~/.local/lib/cni`
	- `~/opt/cni/bin`
	- `/usr/local/libexec/cni`
	- `/usr/local/lib/cni`
	- `/usr/libexec/cni`
	- `/usr/lib/cni`
	- `/opt/cni/bin`