Docker improvements -- use scratch

Hello all, I wanted to point out a few things regarding docker. Happy to raise a PR but wanted to check if you guys are on board with this. Looking at the main [Dockerfile](https://github.com/AdguardTeam/AdGuardHome/blob/6261fb79abdef52889a2f87b1330225ea1c3c696/Dockerfile).

> ```FROM alpine:latest```

Can be removed and set to `FROM scratch`. This will allow it to have even less unnecessary things in the container. From what I can see, the only thing that's really required is the `ca-certificates`, however, this can be installed, and then copied from a previous build (iirc simply copying /etc/ssl is plentiful).

> ```RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome```

this capability is unnecessary as this only applies inside the container. But why is it important for the service within the container to be bound to ports lower than 1024? What really matters is the port it's assigned to on the host, because at the end of the day, the port on the host is what will be talked to by the clients.
Suggestion: remove the who capabilities piece, and simply bind to ports everything above 1024 (e.g. 1053, 1067 etc). Then suggest within the docker run command to do the correct bindings (i.e. `docker run -p 53:1053` etc).

> ```nobody```

Obviously, since alpine doesn't exist, the user/group "nobody" won't exist anymore either. This is easy to circumvent, simply create a file called `passwd.minimal` (or whatever you wanna call it), and add it into the container: `ADD passwd.minimal /etc/passwd`. This way you'll be able to use `USER nobody` and continue to keep the file permissions as `nobody`.

> ```COPY --from=build --chown=nobody:nogroup /src/AdGuardHome/AdGuardHome /opt/adguardhome/AdGuardHome```

If the first two things are addressed, the location of the binary and configs are now redundant and don't matter. No need to create `/opt/AdGuardHome` dir etc. Simply just copy the file to `/adguardhome` and set that to the entrypoint.

The above should allow for a container that only contains the binaries and the ssl certificates. And while using Alpine often is better than using alternative base images, the above massively reduces attack surface compared to even alpine linux, and further prevents vulnerabilities such as the recent CVE-2019-5021.