ci: allow unrestricted user namespaces in image builds (#3587)

Since Ubuntu 23.10, creating namespaces, e.g. via `unshare`, requires
privileges. Since `unshare` is used by `mkosi` in our image build
pipeline, we need to re-enable them explicitly here before building the
image, aligning with the behavior before Ubuntu 23.10.

.github/workflows/build-os-image.yml

@@ -167,6 +167,12 @@ jobs:
         with:
           clouds_yaml: ${{ secrets.STACKIT_IMAGE_UPLOAD_CLOUDS_YAML }}
 
+      - name: Allow unrestricted user namespaces
+        shell: bash
+        run: |
+          sudo sysctl --ignore --write kernel.apparmor_restrict_unprivileged_unconfined=0
+          sudo sysctl --ignore --write kernel.apparmor_restrict_unprivileged_userns=0
+          
       - name: Build and upload
         id: build
         shell: bash