This caused issues in various areas where Pat (and/or dependencies)
relied on os.TempDir() store temporary files. E.g. when running `pat
updateforms`.
We can't do this inside the build container, as there is no way of
specifying file permissions when doing COPY --from. The solution
(inspired by the distroless images) is to ADD a pre-prepared tarball
with the correct file permissions.
`mkdir -m 01777 tmp && tar --owner=root --group=root -cf tmp.tar tmp`
Set ENTRYPOINT to the Pat executable, and use CMD to provide default
arguments. By doing this, users can run on-off commands with docker as
if the app was running natively on the host.
E.g. `docker compose run pat interactive`.
