Improve quality of helix Dockerfiles

There are opportunities to improve the helix Dockerfiles.

- **Make the Dockerfiles non-root:** The Dockerfiles define a non-root user, but install `sudo` and give that user [`sudoer` permissions](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/debian/12/helix/amd64/Dockerfile#L41-L47). That means that the resultant container images are effectively `root` images. That's not great.
- **Base on runtime-deps:** We already have official images for running .NET code in containers w/baseline dependencies. We should use them and not guess. Where we don't have the correct `runtime-deps` image, we should ask for one.
- **Limit dependencies**: This [Alma Dockerfile](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/almalinux/8/helix/amd64/Dockerfile) works so why does this [Debian Dockerfile](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/debian/11/helix/amd64/Dockerfile) install so many packages? We should define the min set and stick to that.
- **Use Python idiomatically**: There are multiple opportunities to improve how we use Python. Those are listed later.

Opportunities to improve Python use:
- **Install `pip` one way:** First, we install `pip` [via apt](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/debian/11/helix/amd64/Dockerfile#L26-L39), then install `pip` via `curl`, and then upgrade `pip` via `pip`.
- **Adopt [`venv`](https://docs.python.org/3/library/venv.html):** `venv` seems to have replaced [`virtualenv`](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/debian/11/helix/amd64/Dockerfile#L40) for most use cases. `venv` comes with Python. In the case of Debian, we can install it via `python3-venv` in recent Debian versions. Also, if you use `venv`, you don't need to separately install `pip`.
- **Use the standard directory for `venv`:** The `venv` docs suggest that `env` is the default name. We are using [`.vsts-env`](/home/helixbot/.vsts-env). Is that to align with scripts that are run in multiple environments?
- **Install packages via `venv`**: This approach will enable us to stop using [`--break-system-package`](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/e2ac99efb806885c8c253fa80aa65ca98e4ac3bb/src/debian/12/helix/amd64/Dockerfile#L39)

Related issues:

- https://github.com/dotnet/dnceng/issues/1312
- https://github.com/dotnet/aspnetcore/issues/48221
- https://github.com/microsoft/msquic/issues/3625