Refactor Docker pull logic into dedicated package

Follow-up from #26558 (closed):

Ideally if time allows it, we should move all the pull policy logic into it's own package, for example executors/docker/internal/pull.