Run Docker container as srclib (unprivileged user)

@beyang, this is a necessary change going forward, for security. I haven't tested this yet, but this general boilerplate has worked in the other toolchains' Dockerfiles.