Use non-privileged scratch for production Docker images

[rumyantseva]

Fun fact: surprisingly, I found the answer in the only book about Docker I own 😄

Description

In this change, in the Dockerfile state dir is created explicitly, and in the final stage, its ownership is assigned to the necessary user through --chown flag. This explicitly sets ownership, and even if a docker container would be run with an anonymous volume (e.g. through docker run without setting -v or --mount), the ferretdb user will have the necessary permission.

In case, volume is specified when starting the container, the specified volume will be used.
E.g. something like docker run -v ./state:/state my-ferretdb-image would work without having those mkdir and COPY.

Closes #3992.

Readiness checklist

• I added/updated unit tests (and they pass).
• I added/updated integration/compatibility tests (and they pass).
• I added/updated comments and checked rendering.
• I made spot refactorings.
• I updated user documentation.
• I ran task all, and it passed.
• I ensured that PR title is good enough for the changelog.
• (for maintainers only) I set Reviewers (@FerretDB/core), Milestone (Next), Labels, Project and project's Sprint fields.
• I marked all done items in this checklist.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 74.66%. Comparing base (407fbb8) to head (a464e53).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4211      +/-   ##
==========================================
- Coverage   75.14%   74.66%   -0.48%     
==========================================
  Files         339      339              
  Lines       22910    22910              
==========================================
- Hits        17215    17106     -109     
- Misses       4388     4483      +95     
- Partials     1307     1321      +14     

see 23 files with indirect coverage changes

Flag	Coverage Δ
filter-false	?
filter-true	68.16% <ø> (-0.73%)	⬇️
hana-1	13.91% <ø> (ø)
integration	68.16% <ø> (-0.80%)	⬇️
mongodb-1	5.13% <ø> (-0.01%)	⬇️
mysql-1	?
mysql-2	?
mysql-3	?
postgresql-1	46.51% <ø> (-0.12%)	⬇️
postgresql-2	49.54% <ø> (-0.18%)	⬇️
postgresql-3	49.81% <ø> (-0.13%)	⬇️
sqlite-1	45.66% <ø> (-0.17%)	⬇️
sqlite-2	48.80% <ø> (-0.08%)	⬇️
sqlite-3	48.97% <ø> (-0.13%)	⬇️
unit	32.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.