Add CI job for buildbox-run-userchroot

This is a follow-up to #1177 (closed). The buildbox-run sandboxing backend has been merged with a CI job that uses buildbox-run-bubblewrap and buildbox-fuse. We still also want a CI job for buildbox-run-userchroot, though. This is currently blocked by changes required in userchroot.

Relevant MRs:

• !1751 (merged) Add CI job to test buildbox-run-userchroot
• buildstream-docker-images!148 (merged) Add userchroot image
• BuildGrid/buildbox/buildbox-run-userchroot!11 (merged) Install/uninstall devices
• https://github.com/bloomberg/userchroot/pull/14 Improve isolation and robustness on Linux
• https://github.com/bloomberg/userchroot/pull/15 Replace owner check with access check for --install-devices