Add container exclusions to non root policy

In the process of implementing https://repo1.dso.mil/platform-one/big-bang/bigbang/-/issues/1276 we realized this policy did not support container exclusions. Some more background here. This policy required a new helper to support exclusions and not diverge from the original policy.