[meta] mitigate scriptworker rollout bustage

Recently, we rolled out an entire set of new k8s scriptworker pools via a push to the production branch, and a) the signingscript pool was busted because it was claiming tasks but had an incompatible version of osslsigncode due to a moved python:3.8 docker hub tag, and b) the rest of the pools were busted because they were using a version of scriptworker that didn't successfully claimWork.

On top of this, we didn't have an established, documented way of rolling back k8s pools; each person had their own way of doing so, or none at all. So:

1. Let's run scriptworker integration tests in CI,
2. pin the FROM image digest in Dockerfiles,
3. add signingscript integration tests, and
4. document scriptworker k8s pool rollback.

Beginne mit den vier verknüpften Issues: Integrationstests von scriptworker in CI, Pinning des Base-Image-Digests im Dockerfile, Integrationstests von signingscript und dokumentierter Rollback des Kubernetes-Pools. Prüfe jedes Issue, um seinen separaten Umfang zu bestimmen; dieses Meta-Issue ist abgeschlossen, wenn alle vier Folgeaufgaben abgeschlossen sind.