Run the web container as a non-root user #609

Part of #607.

Why

Containers should run as a non-root user (least privilege). The worker image already does this
(USER $APP_UID). The web image has no USER line.

Scope

• Add USER $APP_UID to the base stage of src/DfE.CheckPerformanceData.Web/Dockerfile, as in the
  worker Dockerfile.
• Make sure nothing in the web app writes outside the paths the app user can write to (for example
  the data-protection keys go to blob storage, not to disk).
• Set run_as_non_root = true on both module "web_application" and module "rules_engine_worker"
  in terraform/application/application.tf.

Done when

• The web container runs as the app user in a review app (id in the pod shows a non-zero uid).
• The pods start with run_as_non_root = true.
• The E2E smoke tests pass on the review app.