Add 'user' parameter to run command

Allows the user to explicitly choose what username (which must exist in
the container) to run the process as. The default behaviour matches the
current behaviour; that is the user is 'vcap' if the privileged flag is
false, or 'root' if it is true.

The current intention is for the privileged flag to determine whether
the container maps users in the container to users in the host. When the
privileged flag is true, the root user in the container will also be the
root user in the host (which is today's behaviour). When it is false,
the root in the container will have a different uid in the host. Adding
the user flag allows the new case where privileged is false (therefore
the root user in the container is not root in the host) but the user
wishes to run a process as the container root user. Additionally this
flag is generically useful to give more control over which user a
process should run as in the case where a container contains multiple
users.

[#82838924]