Respect USER directive from OCI image config

Add support for the Dockerfile USER directive so that the container's
CMD/ENTRYPOINT runs as the configured user instead of root.

Changes:
- inject.rs: Add user field to Config struct, write /slim/user at
  build time
- build.rs: Pass config.user through to inject()
- slim-init.sh: Read /slim/user and drop privileges via su before
  executing the command. Numeric uids are resolved to usernames via
  /etc/passwd (BusyBox su does not accept numeric args). When dropping
  privileges, run as a child (not exec) so PID 1 stays root and can
  poweroff after the command exits.
- test.sh: Add test_user verifying build-time CMD and --cmd override
  both run as the configured user

Closes #7

src/build.rs

@@ -78,7 +78,7 @@ fn build_inner(
     let command = cmd.unwrap_or_else(|| inject::infer_command(&config));
     let exec_script =
         inject::build_exec_script(&command, &config.env, config.working_dir.as_deref());
-    inject::inject(mount_path, &exec_script)?;
+    inject::inject(mount_path, &exec_script, config.user.as_deref())?;
     println!("Injected /slim/ (init + exec)");
 
     match kind {