Fix the following sources of non-determinism in our container image:
1. Touch /etc/apt/sources.list with a UTC timestamp. Else, builds on
different machines will result to different Unix epochs for that
file.
2. Turn "date of last password change" in /etc/shadow into a constant
number.
3. Fix r-s file permissions in groups, due to inconsistent COPY behavior
in containerized Buildkit. This requires creating a full file
hierarchy in a separate directory (see new_root/).
4. Set a specific modification time to the entrypoint script, because
rewrite-timestamp=true does not overwrite it.
