Validate docker pull policies upon reading config.toml

The following discussion from !2623 (merged) should be addressed:

• @pedropombeiro started a discussion: (+1 comment)

  @ggeorgiev_ According to @akohlbecker's suggestion, an invalid pull policy will now be validated during the TOML parsing at startup, instead of when running a build, which makes perfect sense (why wait for a build to learn that your TOML is invalid?) On the other hand, I don't know if this qualifies as a breaking change (e.g. for a user who has an error in a Docker executor config, but never actually runs jobs on it). WDYT?