Add workspace preparation hidden step before clone steps

[lafriks]

We could have a workspace preparation docker image that would be run as root and do necessary tasks to prepare everything so that the skip clone would work and also clone steps could be run as non-root images?

Maybe even a woodpecker server could act as docker registry to serve container image for this so that it would work in instances that have no internet connection

Originally posted by @lafriks in #5056 (comment)