(core) add gvisor-based sandbox to jenkins test worker image

Summary:
This is preparatory work for running tests with the new sandbox in jenkins.

 * Makes a base image that is now shared by grist servers and jenkins workers.
 * Needed to allow jenkins to run `sudo runsc`.
 * Converged on port 2020 for ssh to workers and servers.

Test Plan: added one runsc-based test and confirmed it was run

Reviewers: dsagal

Reviewed By: dsagal

Differential Revision: https://phab.getgrist.com/D3029

test/server/testUtils.ts

@@ -16,6 +16,7 @@ import { assert } from 'chai';
 import * as chaiAsPromised from 'chai-as-promised';
 import * as path from 'path';
 import * as fse from 'fs-extra';
+import clone = require('lodash/clone');
 import * as tmp from 'tmp-promise';
 import * as winston from 'winston';
 import { serialize } from 'winston/lib/winston/common';
@@ -287,4 +288,23 @@ export async function readFixtureDoc(docName: string) {
   return fse.readFile(srcPath);
 }
 
+// a class to store a snapshot of environment variables, can be reverted to by
+// calling .restore()
+export class EnvironmentSnapshot {
+  private _oldEnv: NodeJS.ProcessEnv;
+  public constructor() {
+    this._oldEnv = clone(process.env);
+  }
+
+  // Reset environment variables.
+  public restore() {
+    Object.assign(process.env, this._oldEnv);
+    for (const key of Object.keys(process.env)) {
+      if (this._oldEnv[key] === undefined) {
+        delete process.env[key];
+      }
+    }
+  }
+}
+
 export { assert };