Container security hardening (phase 2) (#24068)

* Create frigate and go2rtc runtime users in the image

* Add single fix-ownership helper for volume permission migration

* Add init-usermod oneshot for PUID and PGID remapping

* Chown newly created runtime directories to the frigate user

* Run sentinel-guarded ownership sweep during prepare

* Add host-side volume permission migration script

* Guard log directory ownership for user-mode startup

* Fall back to plain s6-log when running without root

* Assert PUID remapping and sweep sentinel in CI smoke test

* Skip the ownership sweep in the devcontainer

* Pin FRIGATE_RUN_AS_ROOT in ownership tests

* Do not record the sweep as complete when a chown failed

* Validate PUID and PGID in the migration script

* Treat a failed ownership scan as an incomplete sweep

* Reject PUID and PGID of 0 during remapping

* Handle symlinks, dry runs, and sentinel write failures in the sweep

* Treat an absent sweep root as an incomplete sweep

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/run

@@ -1,4 +1,12 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-exec logutil-service /dev/shm/logs/certsync
+if [[ "$(id -u)" -eq 0 ]]; then
+    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
+    exec logutil-service /dev/shm/logs/certsync
+fi
+
+# Non-root (--user) fallback: logutil-service cannot change UID, so run
+# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
+# shellcheck disable=SC2086
+exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/certsync