Re-enable `open_basedir`.

Most php libraries should not need access to the filesystem (beyond the
local project filesystem), so enabling `open_basedir` helps guarantee
that these libraries don't do anything fishy.  Overriding this default
is simple enough for any packages that need more permissions.

This also sets up PATH to include the local vendor/bin and global
$COMPOSER_HOME/vendor/bin paths.  These paths supercede the standard
PATH so that they can be relied on.

The composer script itself is installed to `$COMPOSER_HOME/vendor/bin`
(i.e., the `composer global` bin dir).  I don't foresee this being an
issue, but it is possible that it could cause conflicts with composer
packages.  If so, perhaps `$COMPOSER_HOME/bin` would be better.

The default cacert.pem that curl distributes is downloaded and used for
composer.  The composer installer typically does this itself, but its
logic conflicts a lot with `open_basedir`.  While it would technically
succeed in installing to `$COMPOSER_HOME/cacert.pem`, it would only do
so after trying to access restricted global certificate locations,
creating a lot of warnings.

I split off the `open_basedir` settings into a `basedir.ini` file in
order to make it simple to overwrite the defaults without mucking with
composer's dependencies.
Fix name of the image in example Dockerfile.
Separate timezone into a separate file.

Some of PHP's date and time libraries throw warnings when the timezone
isn't set.  It's therefore a pretty good idea to always set it.

However, it should likely be set to a "correct" value, so making it easy
to configure is preferred.  By splitting it out into a separate file, it
makes it easy for child Dockerfile's to overwrite it.
Set timezone to UTC as a sane default.

Using EST was not a great default as that only works for a narrow region
of people (literally ;)).  Instead, setting it to UTC at least gives the
global community an expected standard to rely on (and it's what PHP
defaults to when you don't set it).