ci: Wrap calls with sudo when building toolbox

The mutter image now sets up a non-root default user, so we have to wrap everything with sudo or su.