Actions: backport disallow executing non docker jobs for Windows Container support

[ChristopherHX]

Using this via gitea-actions-runner would be unsafe without backporting this feature from divergent upstream.

Gitea Actions runner configs can still be duplicated and stolen, because they don't support ephemeral mode that this server supports.