Replace host keys via ONBUILD step, not in ENTRYPOINT

No downside to moving it. The only things in ENTRYPOINT should be the
things that must be there (ie. writing to shared VOLUMES and using run
time env vars). This step was not necessary there.