Disallow writing to the refdata directory in job containers

[MrCreosote]

Fixes #530

[codecov]

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.38%. Comparing base (ec145dc) to head (880e9fc).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
cdmtaskservice/app_state.py	0.00%	1 Missing ⚠️
...mtaskservice/externalexecution/container_runner.py	0.00%	1 Missing ⚠️
cdmtaskservice/externalexecution/executor.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #531      +/-   ##
==========================================
- Coverage   53.39%   53.38%   -0.01%     
==========================================
  Files          69       69              
  Lines        5894     5895       +1     
==========================================
  Hits         3147     3147              
- Misses       2747     2748       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.