This still supports the "arbitrary user" use case but with slightly tighter permissions on the end result.
This one is a little bit more "special" other images (due to the existing runtime/entrypoint modification of the directory modes) so I've tried to pick reasonable values for both halves.
I somehow missed Debian in 25b3034e9b0155c3e71acaf650243e7d12a571c1 / https://github.com/docker-library/postgres/pull/1058 (only updated Alpine), so this updates Debian in the same way.