Better support pathogen repositories which place workflows in subdirectories

[tsibley]

…as this is the direction we're moving.

The main change is making the filesystem isolation boundary (i.e. what's mapped to /nextstrain/build in a container) a separate thing from the workflow and initial working directory (i.e. what's given to nextstrain build). In this codebase, these two things are referred to as the build volume (aka opts.build) and the working volume. Historically, the working volume given to the runners for nextstrain build and nextstrain shell was the build volume; now, they're separately considered and sometimes differ.

See the included changelog entry for usage details and rationale. For background, I made the initial proposal for this feature¹ on a PR in our pathogen-repo-template repository and some discussion ensued.

¹ https://github.com/nextstrain/pathogen-repo-template/pull/16#issuecomment-1911079700 or https://github.com/tsibley/blab-standup/blob/master/2024-01-25.md

Related issue(s)

Based on #354.

Checklist

• [x] Checks pass

[tsibley]

Some new tests are failing on Windows, due to path handling.

Expected:
    NamedVolume(name='build/ingest', src=...Path('.../tests/data/pathogen-repo/ingest'), dir=True, writable=True)
Got:
    NamedVolume(name='build\\ingest', src=WindowsPath('D:/a/cli/cli/tests/data/pathogen-repo/ingest'), dir=True, writable=True)

I'll fix it up.