Containers: Relax docker/remote colocation constraint when appropriate

We prefer the remote resource to be allocated to the same node as the
corresponding container, but there are situations where it is safe to
allow it to run elsewhere.

We may want to expand this capability to other scenarios in the future,
but for now limit it to bundle resources since we generate the resources
for those and know they are safe.