Allow a specific user to be selected to run a process

Assumes that user is already present in the container, and overrides the
'privileged' field if specified.

[#82838924]
apply user namespacing

this doesn't change any behavior; simply maps root to root and the container's
user to the container's user.
Fix up tests to work with user namespacing.

[#82838560]
Bump to latest garden

[#82838560]
Do mounts and networking config in host.

Once the root user is not always container root, it may not have
permissions to execute mounts and networking operations inside the
container. Therefore we have to do these operations in the host.

Also explicitly setuid and setgid to 0 so that we become container root
before running hook scripts.

We no longer have permissions to delete tmp/garden-host by the time the
container is created, so for now we're going to have to leave it.
See #83193088 which tracks figuring out how to delete this.

[#82838560]
Allow root user to be mapped to another user in the host.

This allows containers to be run as root without giving them host-level
root access (assuming no kernel bugs). It also means that containers
running as non-root users are prevented from gaining host root even if
they manage to escalate to root inside the container.

By default all containers are now created with non-host-root
permissions. The 'privileged' flag on creation has been added to
override this behaviour and permit a container's root user to also be
the host root user.

NOTE: This means that users who need to run, for example,
networking scripts within the container must now specify the
'privileged' flag on container creation (rather than just on the run
command).

* Also backfill a test for hostname being set to container ID
* Swap to using nc rather than ping in ip_test because unprivileged
  containers no longer allow ping to be run

[#82838560]