Allow listening on privileged ports (below 1024) as non-root

[jjlin]

This is done by running setcap cap_net_bind_service=+ep on the executable in the build phase (doing it in the runtime phase creates an extra copy of the executable that bloats the image). This only works when using the BuildKit-based builder, since the COPY instruction doesn't copy capabilities on the legacy builder.

[jjlin]

Note that executables running as non-root actually can already bind to "privileged" ports even without setting cap_net_bind_service in Docker 20.10.0 and later (see moby/moby#41030).

Nevertheless, setting cap_net_bind_service should still be useful for people running earlier versions of Docker, or using another container runtime that doesn't have this change.

[jjlin]

~~https://hub.docker.com/r/jjlin/vaultwarden/tags shows the results of this PR~~