campaigns: handle non-root volume use cases more gracefully

Created by: LawnGnome

This builds on #433 to handle the case where a user explicitly selects -workspace volume: we have to inspect the first container when creating the workspace when that happens, so we might as well do that anyway and keep the best workspace detector simple.

The major catch here is that workspace creators now have to have knowledge of the campaign spec steps, but I don't really see a clean way around that.

Implementation wise, this splits out our Docker image handling into a new internal/campaigns/docker package. This creates a fairly noisy looking diff, but it's not wildly different from what we had conceptually; it just unifies some of the details and simplifies the code in internal/campaigns, particularly in Service.

Fixes #432 (closed).