Draft: Configure image to run as non-root by default

[NiklasRosenstein]

Updates the image to run as a non-root user (id=10000, name=main), with permission to install additional packages using sudo apt-get (configured in /etc/sudoers). All tools that would usually be installed into the user's home directory (/home/main) are installed into /opt instead (that is Pipx installed tools, Rustup and Cargo home).

Using this image in GitLab CI

• From what I can tell so far it seems GitLab CI always checks out the repository as root, but uses broad permissions (rw-rw-rw and vice versa) on the $CI_PROJECT_DIR. In order to avoid Git complaining with fatal: detected dubious ownership in repository, we need to run

  git config --global --add safe.directory $CI_PROJECT_DIR
  

  at the beginning of the CI job (we can do this in pre_build_script).

• The "Clear runner caches" button needs to be pressed to remove the cached build/ directory which is also owned by root from previous runs but does not have broader permissions.