replace scratch

[actualben]

There are things missing from scratch that I think we should normally have in our builds:

• /etc/passwd with entries for root, bin, daemon, nobody, and nonroot
• /tmp

...and optionally these things which have some heft:

• tz-data
• ca-certificates

I want to standardize on a nonroot account (with the same UID/GID) across any images that specify a user. So I think I should make a backplane/scratch (or something) and use that.

• lsb has some thoughts on passwd
• distroless does this: https://github.com/GoogleContainerTools/distroless/tree/main/base
• busybox does some stuff: https://github.com/docker-library/busybox/blob/master/latest/musl/Dockerfile.builder