more bugfixes & clarity in readme

- Better info about $DATA_VOLUME and $SFTP_CHROOT in README.md
- Smaller fixes and refinements to README.md
- Fixed wrong order of events when setting $SFTP_CHROOT
- Fixed setgid not being set on the shared chroot/files
- Fixed password env var being kept after setup, which is just a silly risk
- Split up user and chroot setup, preventing failure upon user conflict