refactor: Lint all docker files with Hadolint

[amolenaar]

Update dockerfiles to adhere to the (almost) default rule set of Hadolint.

I lowered the severity level of the following rules, since they would result in a change in the behabior of the dockerfiles.

• DL3002 - Last user should not be root.
• DL3006 - Always tag the version of an image explicitly. (we use variables foir tag names, see also fix: fp in DL3006 hadolint/hadolint#942)
• DL3008 - Pin versions in apt-get install. (would be a lot of work to maintain)

See #150. This adds Hadolint.

Initially I added hadolint as a pipeline step, however, I think it's way more effective as a pre-commit hook.

In order to function as a gate, I moved the pre-commit job in front og the build-and-deploy job.

NB. This PR remains in building state, since the pre-commit job has been merged with the build job.

May conflict with #119.

[dominik003]

Nice addition to our pre-commit here! It might make sense to close #119 as there is a clear rational behind having it and it doesn't hurt to have it (see DL4006).
In addition, I added one comment about moving the pre-commit job back to a separate file and use on together with workflow_run to create the dependency.

[amolenaar]

All Dockerfiles now define a non-root user at the end (where needed).