USER improvements to prevent root users when possible

The following improvements could help prevent having USER root in an image:

1. Embedding base images' "nonroot" user(s) and possibly use a default such as "nonroot", then simply asserting USER <nonroot> at the end of a final stage post conversion
2. Detecting the creation/use of existing users in the original Dockerfile and preserve them, especially after finished running apk add ... commands which require the addition of USER root

The issue names no files, tests, or entry points. Start by locating the Dockerfile conversion logic for FROM, RUN, and USER directives, then determine how nonroot users from base images and users created in the source Dockerfile should be preserved. Done means converted images avoid USER root where possible without breaking apk commands or existing user behavior.