Gate privileged mode and docker socket mount behind an annotation

[sagar1312]

Summary

What changed

• Build containers no longer get Privileged: true and the host's /var/run/docker.sock bind-mounted in unconditionally.
• Both now default off and are only enabled per-job via the screwdriver.cd/dockerEnabled annotation, using the same hoek.reach(config, 'annotations>...') pattern already used for screwdriver.cd/timeout.

Why

• Every build previously ran with full host-level privileges and direct Docker daemon access with no way to opt out, allowing any build step to escape the container and compromise the host. This makes that access an explicit, auditable per-job opt-in instead of an unconditional default.

Example (before → after)

Before — every build's HostConfig, regardless of job config:

HostConfig: {
    Privileged: true,
    Binds: ['/var/run/docker.sock:/var/run/docker.sock']
}

After — default (no annotation):

HostConfig: {
    Privileged: false,
    Binds: []
}

After — job opts in with annotations: { 'screwdriver.cd/dockerEnabled': true }:

HostConfig: {
    Privileged: true,
    Binds: ['/var/run/docker.sock:/var/run/docker.sock']
}

Test plan

• npm test — full suite passes (22 tests), including two new tests covering the default-off behavior and the annotation opt-in.
• npx eslint index.js test/index.test.js — no new errors (pre-existing max-lines-per-function warnings only).

Out of scope

• No changes to _stop, _findContainers, _removeContainer, _startContainer, or the fusebox/breaker wiring — none of these touch HostConfig.
• No new top-level constructor option; the gate is per-job via the existing annotations mechanism, consistent with how screwdriver.cd/timeout already works.