executor: keep the runners unprivileged

This really is not needed anymore, since runners are just expected to call the client and do some light processing of the results. I however needed to add podman's seccomp policy, to let buildah work in the container!

I cannot test this fully ahead of time because the gitlab runner always pulls the image. So let's cross fingers!