CI: Replace opaque test harness workflows with explicit workflow implementation

[MaisenbacherD]

We want to replace the opaque legacy zenfs test harness with concrete workflow implementations.

This is a requirement for adopting a new self-hosted GitHub runner infrastructure (which we need because of the ZNS devices on which we want to run our tests).

The new self-hosted GitHub runner IaC is to be open-sourced.

Requirements for this self-hosted runner:

• Share NVMe devices
• Update the Kernel periodically (through cron job)
• Security:
  • Running in a dedicated KubeVirt VM, one per repository.
  • Restricted cluster network access: KubeVirt masquerade interface that only opens
    necessary ports.
  • Privileged code execution within the VM ('gh-runner' user). The VM will be reset
    after each workflow run.
  • Running in the gh-runner namespace with NetworkPolicies where
    ssh is just allowed from local IPs, https is just allowed to and from
    external addresses (no access to internal cluster services), access to VM
    image repository access just from local IPs.
  • /etc/hosts.allow and /etc/hosts.deny rules for the gh-runner instaces that
    only allow sshd access from cluster local IPs into the VM.

Configuration required by the GitHub repo that uses the self-hosted runner:

• A single self-hosted runner instance (Kubevirt VM) is only allowed to serve
  one repository
• Optionally: Prevent group of people to allow actions:
  Repo -> Settings -> Actions -> General -> Actions permissions
• Prevent PR's to execute code on self-hosted runner before getting approved:
  Repo -> Settings -> Actions -> General -> 'Require approval for all outside
  collaborators' -> Save
• Restrict write access to the repository with the GITHUB_TOKEN:
  Repo -> Settings -> Actions -> General -> 'Read repository content and packages
  permissions' -> Save
• Preventing GitHub Actions from creating or approving pull requests through the
  GITHUB_TOKEN:
  Repo -> Settings -> Actions -> General -> DISABLE 'Allow GitHub Actions to
  create and approve pull requests' -> Save
• In reviews watch out for code injection and secret leaks within workflows
  (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)

In a GitHub workflow that uses a container, the block device has to be passed
into the container:

...
    container:
      image: ghcr.io/igaw/linux-nvme/debian.python:latest
      options: '--device=/dev/nvme0n1:/dev/nvme0n1'
...

[MaisenbacherD]

Fixes #288