pyz_image: Rule to package a pyz_binary into a Docker image

[evanj]

Uses rules_docker and the distroless base image. This adds bug fixes for known distroless Python image bugs, as well as a test to verify them. Running these tests will require Docker to be installed, which violates some of Bazel's hermetic guarantees.

circleci.sh: add --keep_going to generate all build errors; Ignore targets that don't work on CircleCI since they depend on Docker output