CI: Test that Docker image can run a common set of output spaces without network access

[effigies]

Changes proposed in this pull request

Let's reduce the odds of #1995 coming up again.

• Adds a --network option to fmriprep-docker that allows us to pass the --network option to Docker
• Set --network=none for ds005, which uses AROMA, SyN-SDC, and outputs to a number of spaces including HCP-style CIFTI.

Hopefully this will fail, and then will pass with #1996 in.

Documentation that should be reviewed

[auto-comment]

Thank your for raising your pull request.

Some of the fMRIPRep maintainers will review your changes as soon as time permits.
I'm attaching below a Review Checklist for the reviewers, to check off during the
review.

PR Review

Please check off boxes as applicable, and elaborate in comments below. Your review is not limited to these topics, as described in the reviewer guide

• As the reviewer I confirm that there are no conflicts of interest for me to review this work.

Please check what applies in the following aspects of the PR:

Code documentation

• New functions and modules are documented following the guidelines.
• Existing code required amendments in documentation and has been updated.
• Sufficient inline comments ensure readability by other contributors in the long term.

Documentation site

• The modifications to fMRIPrep in this PR do not require extra documentation. This is a common situation when a bug fix that does not change the code base substantially is submitted.
• This PR requires documentation. The corresponding documentation will be submitted as an additional PR in the future.
• This PR requires extra documentation, and will be included within this PR. Please check the boxes that apply best:
  • An existing feature is substantially modified, changing the interface and/or logic of a module.
  • A new feature is being added, therefore full documentation of it will be included
  • This PR addresses an error in existing documentation.
• Yes, all expected sections of documentation were generated by the CI build, and look as expected

Tests

• The new functionalities in this PR are covered by the existing tests
• New test batteries have been included with this PR

Data

• This PR does not require any additional data to be uploaded to OSF.
• This PR requires additional data for tests.

Dependencies: smriprep

• This PR does not require any update on smriprep; or
• smriprep has correctly been pinned.

Dependencies: niworkflows

• This PR does not require any update on niworkflows; or
• niworkflows has correctly been pinned.

Dependencies: sdcflows

• This PR does not require any update on sdcflows; or
• sdcflows has correctly been pinned.

Dependencies: Nipype

• This PR does not require any update on nipype; or
• nipype has correctly been pinned.

Dependencies: other

• This PR does not require any update on other dependencies; or
• other dependencies have correctly been pinned.

Reports generated within CI tests

• Yes, I have checked the reports of ds005 and they are not modified or the changes are as expected
• Yes, I have checked the reports of ds054 and they are not modified or the changes are as expected
• Yes, I have checked the reports of ds010 and they are not modified or the changes are as expected

[effigies]

First failed. Merged in #1996.