add admin checkbox for setting a repo privileged
convert docker client to interface, add fake

This is useful for tests to inject a faked-out Docker API.
for Privileged repos, run privileged for non-PRs

This has not been real-life-tested. Be warned.

Also, the tests mutate global state, which isn't cool.