Consider running :test precommits in a hermetic environment

:test tasks should generally just run unit tests or fast running tests that use an in-memory (or containerized) fake, but it can be tempting to write simple tests that leverage production cloud services, and not classify them as integration tests (e.g. BEAM-11363). We should have some automation to protect against this - we can run :test tasks in a hermetic environment in precommits.

One possible approach: use a docker container with networking disable (maybe re-use the Beam developer container BEAM-10891)

Imported from Jira [BEAM-11404](https://issues.apache.org/jira/browse/BEAM-11404). Original Jira may contain additional context.
Reported by: bhulette.