By using a limited capacity worker and dedicated database column on
container repositories to mark them as:

* cleanup_scheduled: waiting for a worker pickup (happens after a
cleanup policy execution)
* cleanup_ongoing: worker cleaning up this repository
* cleanup_unfinished: worker cleaned part of the repository but had to
stop
* cleanup_unscheduled: nothing to do