bubblewrap: bind mount /etc/subuid

This file may be required by recent containers tool when doing unshare
actions.

Also make the image build jobs non-voting temporarily since they are
broken by the issue this change fixes.

Also, pin docker image to 2.16.8 for quick-start (squashed in here
to be able to merge again):

The new version 3.0.0 needs some configuration adjustment, git-review is
failing with:
  remote: error: branch refs/publish/master:
  remote: You need 'Create' rights to create new references.
  remote: User: user
  remote: Contact an administrator to fix the permissions

Change-Id: Iab45bf2322edf8a10d2d41a1fc9a098e17a39ea7

.zuul.yaml

@@ -157,7 +157,8 @@
 - project:
     check:
       jobs:
-        - zuul-build-image
+        - zuul-build-image:
+            voting: false
         - tox-docs
         - tox-pep8
         - tox-py35:
@@ -194,7 +195,8 @@
             voting: false
     gate:
       jobs:
-        - zuul-upload-image
+        - zuul-upload-image:
+            voting: false
         - tox-docs
         - tox-pep8
         - tox-py35:

doc/source/admin/examples/docker-compose.yaml

@@ -4,7 +4,7 @@ version: '2'
 
 services:
   gerrit:
-    image: gerritcodereview/gerrit
+    image: gerritcodereview/gerrit:2.16.8
     ports:
       - "8080:8080"
       - "29418:29418"

zuul/driver/bubblewrap/__init__.py

@@ -216,6 +216,7 @@ class BubblewrapDriver(Driver, WrapperInterface):
                      '/etc/lsb-release.d',
                      '/etc/alternatives',
                      '/etc/ssl/certs',
+                     '/etc/subuid',
                      ]:
             if os.path.exists(path):
                 bwrap_command.extend(['--ro-bind', path, path])