system tests: allow/deny Docker namespaces

It may happen that a package developer tests their package against a Docker service that was developed externally, so Elastic developers don't have control over what's in the package.

It may happen that the Docker service will jailbreak out of containers and have access to env variables on the host.

The issue names system tests and Docker services but no files or specific tests. Start by locating the system-test entry point and current Docker namespace configuration, then determine the allowed and denied namespace behavior and validate it with the relevant system tests.

Written by the indexing model from the issue text.