Supply `pre_build` config to run pre-build steps

[andrinr]

Summary

Add a way to handle base images that run as a non-root user, so the tesseract template's apt-get steps don't fail with EACCES on /var/lib/apt/lists/partial.

Motivation

Several common base images default to a non-root USER, which breaks the tesseract template's apt steps:

• Jupyter images (USER jovyan)
• Several NVIDIA NGC variants
• dealii/dealii (USER dealii)

The current workaround is to maintain a custom -root wrapper image by hand and point base_image: at that. This is per-Tesseract toil and easy to drift from upstream.

Proposal

Two possible shapes (not mutually exclusive):

Option A — pre_build hook: run a user-supplied script before the tesseract Dockerfile, so the wrapper image can be built inline.

build_config:
  base_image: \"dealii-root:latest\"
  pre_build:
    script: ./build_base.sh

Option B — runtime_user knob: force the apt-install steps in the tesseract template to run as root regardless of the base image's default USER, then restore the original user.

build_config:
  base_image: \"jupyter/scipy-notebook\"
  runtime_user: root

Option B covers the common case (apt steps need root); Option A is the general escape hatch.

Impact

Removes the need for hand-maintained -root wrapper images for any base image that defaults to a non-root user.

[dionhaefner]

Dockerfiles now contain USER root by default so the initial motivation for this should be addressed. That said I can still see value for user-defined pre-build steps, so keeping this open in case an acute need arises.