CI hardening project

[bensze01]

This issue tracks the changes we plan to implement to harden our CI against poison pipeline attacks and allow us to move to
a greater level of automatism without exposing our infrastructure to attacks from untrusted code.

• Restrict automatic CI runs to PRs authored by team members or trusted third parties
  • Allowlist implementation: Restrict automatic runs of PR jobs #129
  • Enable automatic runs on both CIs with the allowlist in place
• Isolate Linux tests from the external environment
  • Move all test code that accesses the network into the mbedtls-test repository
  • Switch all Linux docker containers to network driver none
  • Restrict SYS_PTRACE capability to gdb tests
  • Enable automatic runs of the isolated subset of tests for untrusted contributions for PR pre-screening
• Isolate FreeBSD tests from the external environment
  • Move all test code that accesses the network into the mbedtls-test repository
  • Replicate FreeBSD test environemnt using Podman/Buildah
  • Containerize FreeBSD tests
• Isolate Windows tests from the external environment
  • Move all test code that accesses the network into the mbedtls-test repostiory
  • Replicate Windows test environment using Docker
  • Containerize Windows tests