Add OWASP best-practices

[mfhepp]

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

1. read-only filesystem (but we likely need /tmp), so --read-only --tmpfs /tmp
2. drop Linux kernel capabilities
3. Prevent adding new ones via –no-new-privileges flag.
4. Disable inter-container communication (--icc=false)see OWASP
5. Ensure that OS packages versions are pinned (from OWASP)
6. Avoid the use of ADD in favor of COPY (from OWASP)
7. Avoid curl bashing in RUN directives(from OWASP)

[mfhepp]

• No. 1 - 3 are straightforward to implement
• No. 4 has to be implemented on the host system
• No. 5 is IMO of limited use because the base system is Debian stable (currently bookwork-slim), where freezing a particular version looks like overkill or even preventing bugfixes.
• No. 6 and 7 are currently met (but may need to be checked in actual projects based on py4docker).