Find a way to use latest runc in VM workflows

[skl]

Since CVE-2025-52565, the OBI VM workflows started failing with unsafe procfs detected. A workaround was implemented in #870 which effectively pinned runc to an older version, by running the alpine:3:20 image - this is not ideal because we no longer receive updates, and there's a risk this older image might become patched, or deleted.

A longer term solution is needed so that we can run the latest post-patch version of runc, or some other way to run the nested virtualisation workflow on older kernels.

Some ideas:

• Await documented workarounds/flags to disable unsafe procfs detection
• Try recompiling the kernels with different configuration
• Try a different container engine
• Somehow avoid nested virtualisation
• Offload the build to a remote/self-hosted agent/service

Relates to:

• ci: use alpine:3.20 to workaround insecure runc procfs #870