No network connectivity in build containers

[esben]

By running all build steps in Docker containers without network connectivity, problems with build reproducability caused by non-reproducable network communication is removed.

Fetching of source code and other build step inputs must of-course then be handled in another way.

[esben]

Maybe adopt a similar approach as Baserock (http://www.baserock.org), where all fetching is done using git. Anything that is in git upstream, is then mirrored to a git repository (using Trove).

With this approach, we could streamline fetching and signature handling much more, as we are only fetching from git. And with fetching being much simpler, it becomes more realistic to do a clean integration that is not running inside build containers.

Further, by doing this, the problem of sharing fetch caches goes away. There will be only 1 fetcher, and all build steps simply get the sources added to the container before start.