Implement user/group metadata setting

[baronfel]

Two new string properties:

• ContainerUser
• ContainerGroup

If ContainerGroup is specified, ContainerUser must be specified as well.

Will be emitted to the User field of the image config in the form <user string value> if only ContainerUser is specified, <user string value>:<group string value> if both are specified.

References
https://github.com/opencontainers/image-spec/blob/main/config.md

[baronfel]

Note that this does not imply changing user/group permissions on Layer content - that's entirely separate configuration and plumbing. This is only about the User property of the config of an Image.