Sanitize how we handle the --ssh option in the api docker container.

refs #3219
Be smarter about building and the --realclean option:

* remove intermediate containers after a successful build
* --realclean removes only images labelled arvados/*
* --realclean removes only arvados containers

refs #3219
Update the documentation to reflect the new, safer build.sh --realclean
behavior.

refs #3219
Merge branch '3219-further-docker-improvements'

refs #3219