Cannot start function container when container user does not exist within crossplane-xfn container

### What happened?

Working on https://github.com/crossplane/crossplane/pull/4261 required creating a custom, but simple function image that labels all managed resources with a given label. My first idea was to use `yq` for that and the initial `Dockerfile` was just:

```Dockerfile
FROM mikefarah/yq:4.34.1

COPY labelizer.sh /bin

ENTRYPOINT ["/bin/labelizer.sh"]
```

with `/bin/labelizer.sh` being just:

```sh
#!/usr/bin/env sh

yq '(.desired.resources[] | .resource.metadata.labels) |= {"labelizer.xfn.crossplane.io/processed": "true"} + .'
```

Unfortunately, adding this function to a composition resulted with the following error in `crossplane-xfn` logs:

```
cannot compose resources: cannot run Composition Function pipeline: cannot run function "labelizer":
cannot run container: rpc error: code = Unknown desc = exit status 1: xfn: error: spark.Command.Run():
cannot create OCI runtime bundle: cannot write OCI runtime spec: cannot create new spec:
cannot apply spec option: cannot resolve user specified by OCI image config:
cannot resolve UID of user "yq" that doesn't exist in container's /etc/passwd
```

Modifying the image to use root to run the script resolved the issue.

### How can we reproduce it?

* deploy crossplane with enabled composition functions
* build and publish the function image using files stated above
* create a composition referring that function

### What environment did it happen in?

The issue is spotted on the latest master, but I am pretty sure that versions containing composition function feature suffer from the same issue.

### Expectations

Function containers should be successfully invoked independently if container user exists within `crossplane-xfn` container/image. We should even encourage function authors to use some arbitrary high/random UID for function.

Commencez par reproduire l’échec avec le Dockerfile et labelizer.sh présentés dans l’issue, en utilisant une image de fonction dont l’utilisateur configuré est absent de /etc/passwd. Suivez ensuite le point d’entrée Go qui invoque le conteneur OCI et résout son utilisateur. Le travail est considéré comme terminé lorsque les conteneurs de fonction démarrent correctement même lorsque leur utilisateur configuré n’est pas présent dans l’image crossplane-xfn, y compris avec des UIDs élevés ou aléatoires arbitraires.

Rédigé par le modèle d'indexation à partir du texte de l'issue.