Enforce CPU constraints

[mkyl]

Run the task with exactly the number of (virtual) cores specified in resources/constraints.yaml. This has the advantage that if a framework ignores the core constraint provided to it, it still cannot access more cores than allocated.

Some requirements, per @sebhrusen:

• it should work for docker AND singularity.
• it should also work for memory constraints and the behaviour should be predictible and consistent for all modes (for example if we should fail because we requesting too many cores, then the same behaviour should apply for all modes, not only docker).
• the interaction between the existing run_extra_options allowing to pass arguments to the docker instance, and the new enforced --cpus or --memory should be handled correctly: one should always take precedence over the other and possibly emit a warning in case of conflict, but I don't want to prevent users from overriding those params if they know what they're doing.

See #326 for a start.