Officially support running Docker container as non-root

[rfratto]

Request

While the Dockerfile has steps to add a non-root user, support for non-root is undocumented and effectively experimental; we currently don't have experience with it or fully understand the implications of running as non-root.

"Official" support means two things:

• Internal knowledge: we need to dogfood non-root container instances more to get more experience with it.
• Documentation: We need to document how to enable non-root, and document which components require root-level access (such as prometheus.exporter.unix, for one.)
• Fix any issues where components that shouldn't require root access currently do (for example, I've heard there are issues with running discovery.kubernetes as non-root, which is unexpected).

Related: #774

Use case

Run Alloy in environments where containers may not be run as root user.