Simplify mixed Python environment in Groovy-initiated jobs

[gilles-peskine-arm]

#193 was an emergency fix which fixed an immediate issue where CI jobs failed systematically. Since then, when Groovy code on the CI sets up a Python environment, it mixes system packages with a virtual environment. This works for now but is not clearly explained or motivated.

The goal of this issue is to either move completely to a fully isolated virtual environment, or explain clearly both why we aren't doing that, and what difference it makes.