security: env var allowlist + testable OCI config builder

[jw409]

Summary

• Replaces the denylist of non-forwarded env vars in src/helpers/entrypoint.py with an allowlist of just LANG, LC_ALL, LC_CTYPE, LANGUAGE, and TZ. Any other var in the outer container's environment is dropped entirely — neither name nor value appears in the OCI config that gVisor consumes.
• Factors the OCI config build into build_oci_config(command, env) so the final config["process"]["env"] array can be tested directly, not just the allowlist set in isolation.
• Adds tests/helpers/test_entrypoint.py (20 tests, all passing locally) mirroring the src/helpers/ source layout.

Context

This PR ports the env-var hardening from freedomofpress/dangerzone#1454 to this repo, per @apyrgio's guidance that container-image code now lives here. Review comments on 1454 that shaped this rewrite:

• "Retain the original mask-with-<ENV>= behavior" — went with drop instead; see rationale below.
• "Don't just test the allowlist set; test the final OCI config" — done, build_oci_config() is now a pure function the test drives directly.
• "Put tests under tests/container_helpers/ to mirror sources" — done as tests/helpers/ to match this repo's layout.

Why drop rather than mask with <ENV>=

• Allowlist semantics are stricter: we forward exactly what conversion needs. Masking still implies enumerating what to hide; dropping means the name is never written to the config file at all.
• Names themselves are signals: AWS_SECRET_ACCESS_KEY, SSH_AUTH_SOCK, KUBECONFIG, ANTHROPIC_API_KEY — leaking the key name tells an attacker inside the sandbox what the outer context is running. Drop removes that channel.
• gVisor behavior is identical either way: runsc reads config["process"]["env"]; keys not present simply don't exist inside the sandbox. Verified by inspection of the runtime spec.

Test plan

• pytest tests/helpers/test_entrypoint.py -v --local — 20/20 pass
• Covers: baseline env always set, allowlisted vars forwarded verbatim, sensitive names and values absent from the env array, sandbox-control vars (RUNSC_DEBUG/RUNSC_FLAGS) dropped, parent cannot shadow baseline PATH/PYTHONPATH/TERM, hostile values (newlines, nulls, shell injection, embedded =) dropped when key is not allowlisted.
• build_oci_config() is pure — no module-level side effects — so the test loads entrypoint.py via importlib without invoking main().

Supersedes freedomofpress/dangerzone#1454 (moved to draft there, per repo split).

[almet]

Hi, this repository is under heavy works, and so I've force-pushed a few times the main branch. You may want to cherry-pick your changes and reapply them on top of the new main.

Now, to the actual changes. Please keep your changes minimal the much you can: if you're doing an allow-list, do only that and avoid making other changes to the code so that it's easier to review, and also doesn't introduce changes in other parts of the code. This is important as this is a security-sensitive project.

Thanks!