build(docker): add code and labels; run as non-root user

Dockerfile

 # syntax=docker/dockerfile:1
 FROM python:3.8
 
+LABEL \
+    org.label-schema.dockerfile="/Dockerfile" \
+    org.label-schema.license="AGPL-3.0-or-later" \
+    org.label-schema.maintainer="Stefan Hynek" \
+    org.label-schema.name="Textgrid Repository WebDAV Server" \
+    org.label-schema.schema-version="1.0" \
+    org.label-schema.url="https://gitlab.gwdg.de/dariah-de/textgridrep/repdav" \
+    org.label-schema.vcs-url="https://gitlab.gwdg.de/dariah-de/textgridrep/repdav" \
+    org.label-schema.vendor="SUB/FE"
+
+
+RUN useradd --create-home repdav
+USER repdav
+
+COPY --chown=repdav requirements.txt /
+RUN pip install \
+    --no-cache-dir \
+    --requirement requirements.txt \
+    --user
+
 WORKDIR /app
+COPY --chown=repdav src/ .
 
-COPY requirements.txt .
-RUN pip install -r requirements.txt
+ARG build_date
+ARG vcs_ref
+ARG version
+LABEL \
+    org.label-schema.build-date="${build_date}" \
+    org.label-schema.vcs-ref="${vcs_ref}" \
+    org.label-schema.version="${version}"
 
 CMD ["python", "main.py"]
+
+COPY Dockerfile /