let services listed in FRIGATE_ROOT_SERVICES skip the privilege drop

docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run

@@ -4,6 +4,13 @@
 
 set -o errexit -o nounset -o pipefail
 
+runs_as_root=0
+if [[ "$(id -u)" -eq 0 ]]; then
+    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root go2rtc; then
+        runs_as_root=1
+    fi
+fi
+
 # Logs should be sent to stdout so that s6 can collect them
 
 function get_ip_and_port_from_supervisor() {
@@ -110,7 +117,7 @@ fi
 readonly homekit_config_path="/config/go2rtc_homekit.yml"
 setup_homekit_config "${homekit_config_path}"
 
-if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
+if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
     chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
     # go2rtc rewrites this in place (os.WriteFile, no rename), so owning the
     # file is enough; /config grants frigate-data traverse only. Tolerated so
@@ -135,7 +142,7 @@ echo "[INFO] Starting go2rtc..."
 # Use HomeKit config as the primary config so writebacks go there
 # The main config from Frigate will be loaded as a secondary config
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
+if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
     exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
 else
     exec s6-setuidgid go2rtc "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml