feat(Dockerfile)!: use an unprivileged user to run application

Add an unprivileged user to the Dockerfile in both production and development images.

This MR is based on uis/devops/regent-house-ballots/ballots-webapp!83 which was successfully deployed to the development instance with no deployment-side changes needed.

Regent house ballots is a good test because, unlike the bare boilerplate, it installs some system dependencies in order to run tox. This required adding a workaround to the container:tox image in order to run tests as the unprivileged user but still install dependencies.

Specifically the .gitlab/webapp.gitlab-ci.yml file needed the docker command which runs tests changed to:

docker run --rm --network host --entrypoint=""
-e TEST_USE_EXTERNAL_DATABASE -e EXTERNAL_SETTING_DATABASES
--user root
"$APPLICATION_IMAGE"
"/bin/bash" "-c" "apt-get -y update && apt-get -y install pkg-config build-essential libxmlsec1-dev && su --shell=/usr/bin/bash '--command=poetry install --no-root --sync' webapp && su --shell=/usr/bin/bash '--command=poetry run pytest' webapp"

Since some other downstream projects may need similar workarounds, this change is marked as BREAKING.

Closes #122