Allow custom builds in nonprivileged execution

[jonathanmetzman]

We'll do this by uploading new custom builds to a bucket that the untrusted worker can read from. We'll only do this in projects that will use untrusted workers. This will make it impossible to use older custom builds. The custom builds that are still in use, I will re-upload.

I'm doing this because it's too confusing to have some linux jobs that are privileged and others that aren't especially not for a reason like this.

[jonathanmetzman]

CC @pgrace-google