Podmanize

[zancas]

Fixes: #1188

This more invasive change prefers "podman" to "docker" and "Containerfile" to "Dockerfile" wherever possible.

--userns=keep-id is used in all podman run invocations.

[nuttycom]

The CI component of this is made irrelevant by #1193; do we want to continue supporting container-based builds? If so, we should consider a Containerfile that starts from nixos and uses the nix renderer, for consistency.

[zancas]

I will revisit this next time I render the ZIPs.

[daira]

We are not using podman or docker; we are using Nix from now on. I see no reason to maintain more than one deterministic build system. Nix solves the security issues associated with docker.