Add allowed_users config for docker executor

In !4483 (merged) we added the ability to configure the user with which to run a build container, AND made that take precedence over the docker user configured in the runner. That latter part was wrong; the runner config should take precedence. Not only that, but as with pull_policies and allowed_pull_policies, we need to limit the user specified in the job config to a list of allowed users specified in the runner config.