Run ckan and dependencies from a venv, add maintenance user

[wardi]

This would let us

• remove warnings on package install about overwriting system-maintained files
• install dependencies as an unprivileged maintenance user (separate from ckan user) so that admin tasks in the container aren't all done as root (use https://docs.docker.com/reference/dockerfile/#user to set this as the default for docker run use)
• in development use a volume for complete installed virtualenv including bin and other folders, and one for the maintenance home directory for conveniences like .bash_history

In development we can set up an entrypoint that syncs the maintenance UID and GID inside the container with the ones from the mounted /srv/app/src_extensions folder. This lets us do things like create extensions from templates or edit/create files and directories while VS Code debugging without creating a bunch of root-owned files in the host directory.

[wardi]

maintenance likely isn't the best name for this user, any other suggestions?