Clarification on client mode user documentation

### Issue
I've been following the documentation for what kind of user should run the agent in client mode. One sentence says you should run as root but the next says it should be your own user with limited permissions. Was wondering what those permissions should be.

Along those lines, what should the permissions for the data directory be (like where allocations are)?

Currently we run an init service as nomad and I believe we have 755 on our data directory (owned by nomad) but we are unable to execute anything as a different user if the file is in the allocation (such as an artifact.)

Could you update the documentation for the user permissions?

Start with the client-mode user documentation referenced in the issue and inspect the guidance about running as root versus a limited user. Determine the intended user permissions and data-directory permissions, including access to allocation artifacts; done means the documentation clearly resolves both questions.

Written by the indexing model from the issue text.