CI is hitting DockerHub rate limits

On runner ci-runner-x86-03-shadow I've managed to have DockerHub rate-limit our image pulls for a while: https://gitlab.torproject.org/jnewsome/sponsor-61-sims/-/jobs/27802

This makes me wonder whether the runner is caching Docker image layers - maybe cache-dir needs to be set?

Otherwise maybe DockerHub is throttling # of pull requests even when the individual layers end up being cached. That seems harder to solve, if so. I suppose we could change pull_policy to if-not-present, but then we'll have to be a bit careful to avoid/override using stale images.

Not sure how often this will be an issue in the steady state; at the time I hit the limit I was iterating pretty quickly on the script, so restarting the job every few minutes for a while. Unfortunately it doesn't appear trivial to set up a way to locally test.