The implementation of D984 did not include enforcing ownership for
build.CopyFrom instruction and so artifacts copied from one image to
another via copies: were problematically owned as root.
In order to fix this behavior:
- config.ArtifactConfig build.CopyFrom instructions are now injected duration build.PhaseInstall
- config.VariantConfig calls build.ApplyUser for these artifact instructions as well using the runs.as user
- build.CopyAs was refactored to wrap any build.Instruction which should only really be used with build.Copy or build.CopyFrom.