Run student's code as a different user, add timeout

Also need to check if permissions are correctly set on the K8s volume. When running with Docker, at least on macOS, the student user always can access /data.