Enable user namespacing for static test containers

#1925 added static Docker containers that run SSH as root (and probably other things). We should configure user namespacing (and maybe static UID/GID) so that someone who manages to escape from the container does not become root on the host.

Start by reviewing issue #1925 and the static Docker container configuration it introduced. Determine how user namespacing and any static UID/GID mapping should be configured, then verify that container root is not host root and that the static containers retain their required behavior.

Written by the indexing model from the issue text.