Port 'secure-containers' feature to Debian/Ubuntu #1707

I built a rootless docker feature to replace dind/dood. I didn't add Ubuntu support. You could, if you wanted to.

With LLMs writing the sort of code they're writing these days, we all need about twice as many defense-in-depth layers as we used to.