strip nginx user directive when not running as root (#24925)

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -80,6 +80,11 @@ cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
 
 set_worker_processes
 
+# A non-root master ignores `user` and warns on every start
+if [[ "$runs_as_root" -eq 0 ]]; then
+    sed -i '/^user root;$/d' /tmp/nginx/conf/nginx.conf
+fi
+
 # TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
 # contract) always win; otherwise fall back to a self-signed cert persisted in
 # /config/tls, which stays writable under a read-only root filesystem.

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -2,7 +2,7 @@
 # file, all other path directives follow --prefix and must stay absolute.
 
 daemon off;
-# ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
+# keeps workers root under FRIGATE_RUN_AS_ROOT; the run script strips it otherwise
 user root;
 worker_processes auto;