Support arbitrary WORKDIR

Current code requires WORKDIR=/, as this is how the sidecar is run ( using relative paths to allow running as regular user).
The launcher should use absolute paths if running as root, and set workdir when executing pilot-agent.

Ideally in non-root mode it should use files under $HOME/ for the certs - possibly same place with .kube/config, and a temp dir for
generated files (bootstrap), leaving current dir clean.