Kubernetes: rework jump pod provisioning (#3561)

With these changes, run_job() only creates a jump pod,
and it is provisioned in update_provisioning_data() as follows:

- check if the pod is running, try again later if not
- collect all cluster external IPs, prefer the pod's node IP, fall back
  to a random IP if the pod's node has no external IP
- connect to the jump pod, add the user's public SSH key

This patch also fixes a bug introduced in
#3273 where it was not possible
to add another user's public key due to `ForceCommand /bin/false`.

Fixes: #3559

Author: un-def