Review all users and permissions

[tabroughton]

We need to review all system users (eg. www-data) and that containers are being under an appropriate user, that services within containers are being run by the correct users and that all directories and files (especially on the host) have the correct permissions set.

An example of this in #22

[tabroughton]

https://civicrm.org/advisory/civi-sa-2014-001-risk-information-disclosure

[tabroughton]

https://jtreminio.com/blog/running-docker-containers-as-current-host-user/