The implementation of D984 did not include enforcing ownership for
build.CopyFrom instruction and so artifacts copied from one image to
another via copies: were problematically owned as root.

In order to fix this behavior:

1. config.ArtifactConfig build.CopyFrom instructions are now injected duration build.PhaseInstall
2. config.VariantConfig calls build.ApplyUser for these artifact instructions as well using the runs.as user
3. build.CopyAs was refactored to wrap any build.Instruction which should only really be used with build.Copy or build.CopyFrom.

Run go test ./.... Run blubber against configuration with a variant that
uses copies and verify that the COPY --from instructions also include a
--chown flag.