21657: Update docker archive ID introspection code for OCIv2.

21657: Update docker archive ID introspection code for OCIv2.

Also, when not using the built-in image, we already rely on having
docker tools available, so use `docker inspect` instead of trying to
read the tarball.

This way the introspection code now only needs to work on the built-in
image.  And now there's a test for that.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>