This caused issues in various areas where Pat (and/or dependencies)
relied on os.TempDir() store temporary files. E.g. when running `pat
updateforms`.
We can't do this inside the build container, as there is no way of
specifying file permissions when doing COPY --from. The solution
(inspired by the distroless images) is to ADD a pre-prepared tarball
with the correct file permissions.
`mkdir -m 01777 tmp && tar --owner=root --group=root -cf tmp.tar tmp`
