ci: lib: Update for latest ansible container image

The latest version of the *ansible* container runs processes as the
unprivileged *jenkins* user, provides its own "sleep forever" default
command, and sets the correct LANG environment variable.  Since it runs
processes as *jenkins*, we need to override HOME and set it to the
WORKSPACE to ensure Jenkins has a writable path for arbitrary files.

vars/applyConfigPolicy.groovy

@@ -13,16 +13,15 @@ def call(rw_limit, stages) {
                 containerTemplate(
                     name: 'ansible',
                     image: 'git.pyrocufflink.net/containerimages/ansible',
-                    command: 'sleep',
-                    args: 'infinity',
-                    envVars: [
-                        envVar(key: 'LANG', value: 'C.UTF-8'),
-                    ],
+                    alwaysPullImage: true,
                 )
             ]) {
                 node(POD_LABEL) {
                     checkout scm
-                    withEnv(["KRB5CCNAME=${WORKSPACE}/.krb5cc"]) {
+                    withEnv([
+                        "HOME=${WORKSPACE}",
+                        "KRB5CCNAME=${WORKSPACE}/.krb5cc",
+                    ]) {
                         container('ansible') {
                             try {
                                 stageKinit()