[shim] Keep shim task files out of the container

[un-def]

~/.dstack/runners/<name> is mounted into the task container as /tmp/runner. It used to hold runner's files only, but shim now keeps its own files there as well -- the image pull log since #2903 and the task state file since #4220 -- sharing them with the runner and the user workload, which may corrupt or delete them. Nothing sensitive is stored there today, but the approach is unsafe: nothing stops a contributor from putting a secret into a file the container can read.

That dir is now the task dir, private to shim, and only its new runner subdir is mounted into the container:

~/.dstack/runners/<container-name>/  0700, shim only
  task.json
  pull.log
  runner/                           0755, mounted as /tmp/runner

• runnerDir/runnersDir are renamed to taskDir/tasksDir throughout, including the DockerParameters methods, to signal that the dir is managed by shim rather than by runner. The runners path itself is kept: an upgraded shim must find the dirs of the tasks created by the previous version.
• The dir of a restored task is no longer derived from the container mounts, which now point at the runner subdir, but from the task ID in its state file. The tasks dir is scanned once on start, and the result is shared by the restore and the orphan sweep, which used to scan the dir a second time.
• A task started by a shim version that did not write state files cannot be found by its state file, so its dir, named after the container, is looked up by name and, as before, removed along with the task.