Cleaned up for production use

Installing pertino now happens in the build and at runtime it just does
the authentication.
The installation is also now secure from MITM attacks since the gpg key
is embedded into the Dockerfile and doesn't need to be downloaded.

Entrypoint changes also makes it easier to just fire up a container from
this image but with bash instead, meanwhile still having everything
setup to be able to fire up the client.

Updated README to use much better instructions on how to take full
advantage of this while still being able to run applications using the
client in a secured way.  Running applications with `--privileged` is
REALLY REALLY (REALLY) bad since this gives full acess to the docker
host.

TODO: Figure out what kernel caps are actually needed by the client.
NET_ADMIN was not enough to allow the client to run. This way the user
could just enable the caps needed instead of giving full `--privileged`
access

Signed-off-by: Brian Goff <cpuguy83@gmail.com>