4027: Revamp SSH use in our Docker images.

* Don't install or run SSH in most of our Docker images.  `docker
  exec` is now preferred to inspect running images.

* Do run SSH on the API server, always, for Gitolite.

There is a feature regression here: the user's SSH key is not
automatically installed on the shell account.  This needs to be fixed
another way.  In the meantime, it's not difficult to run
`docker exec -ti --user=self shell /bin/bash`, and you can clone the
repository from the host system.
4027: Bugfix update-gitolite.rb in Docker.

* Load a YAML library.

* Support ARVADOS_API_HOST_INSECURE, and set it in normal Docker use.
4027: arvados/jobs includes virtualenv.

This lets you use the arvados/jobs image with the arvados_sdk_version
feature of Crunch.
4027: Crunch installs jobs' requested arvados_sdk_version.

* crunch-dispatch fetches the requested SDK version into its internal
  git repository, just like it does for the Crunch script.  Refactored
  crunch-dispatch to make that code reusable.

* crunch-job's main script archives the sdk subdirectory as of that
  commit, sending it along to compute nodes in the same .tar as the
  Crunch script, under .arvados.sdk.

* crunch-job's __DATA__ dispatch section looks for the SDK under
  .arvados.sdk, and installs it as much as possible.

Since I was messing with it so much already, I changed the semantics
of crunch-job's __DATA__ section: it is now either in installation
mode or run mode, based on whether there's anything in @ARGV.  I
confirmed that this is consistent with current calls to the section.
4027: crunch-job logs its own version information.

By request in code review, to help detect situations where
crunch-dispatch and crunch-job are out of sync.
Merge branch '4027-crunch-sdk-install-wip'

Closes #4027, #4667.