Testcases fail to pull the latest docker images if they are already present on the system

bluval/blucon only execute a `docker run` without an explicit `docker pull`, so if the images with the desired tags already exist on the system, they are used as-is without pulling the latest upstream tag.

This currently leads to failing bluval jobs, since the image present on the hosts in the Enea lab are there before some security tests were marked as non-critical.