Pull containers

[sjpb]

• Pulls container images during fat image build and before service start. This avoids service start failures from slow pulls / docker.io rate limits.
• Can optionally disable base OS package updates during image build to speed-up debugging.
• New fat image build:
  • Includes container images, as above.
  • Now requires 12GB root disk.
  • Includes OpenHPC v2.7.1, which provides Slurm 22.05.11 addressing Slurm CVE-2023-49933 through CVE-2023-49938
• Removes the move of podman tmp dir to a tmpfs//tmp introduced by Use systemd for opendistro/kibana/filebeat #52; this appears to no longer be necessary (i.e. containers/services restart OK after a reboot) and in fact causes any podman to fail after a reboot with Error: cannot re-exec process to join the existing user namespace.
• Uses FIP for fat image build on Arcus to avoid docker rate limits on network outbound IP

[sjpb]

Fat image build: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/7541194661 openhpc-240116-1156-aa8dba7d

[sjpb]

at 55b3517:

1. manually deployed cluster
2. checked podman commands worked, containers running, services up
3. rebooted control node
4. repeated step 2

[m-bull]

LGTM - thanks for all of the debugging effort!