Sanitize the final container image for envbuilder

[mafredri]

As part of #128, we want to sanitize the container images that are pushed to a registry (see #213 for the push implementation).

The motivation is that when running a pre-built image, envbuilder should be able to perform the tasks listen in devcontainer.json to finalize the environment (e.g. run scripts).

Example sanitization directives that can be appended to the Dockerfile:

USER root
WORKDIR /
ENTRYPOINT ["/.envbuilder/bin/envbuilder"]

Note, ENTRYPOINT is dependent on #216.