[fix] Enable (most) wrapping when seeing USER directive

[viega]

• Followed the steps in the contributor's guide: https://crashoverride.com/docs/other/contributing#filing-the-pull-request
• PR title uses semantic commit messages
• Filled out the template to a useful degree

Issue

Closes #33

Description

Implements changes discussed in #33 that make wrapping in the face of a USER directory work in most cases. In particular:

1. Whenever Buildkit is used and the docker version is 20 or higher, use the --chmod flag to COPY.

2. If # 1 doesn't apply, and the last section has a USER directive, then we switch the USER to root before the copy/chmod, then we switch it back at the end.

If neither apply and there is a user inherited from a base image, then wrapping will generally still fail.

Testing

This is still in draft b/c there's no test yet. Ideally, we would do all three of:

1. Create a basic container with a USER in the last section, see if it works. Should build via chalk.
2. Use the same Dockerfile, but try it with BUILDKIT disabled. Should build via chalk.
3. Create a two-section dockerfile, with the USER directive in the first section. Should kick to the failsafe path.

[miki725]

👍 this has edge cases however this is prolly good enough for most people as buildkit is pretty popular and we documented current limitation in release notes