dockerfile static analysis

[glvnst]

automate some correctness checks and attempt to enforce local policies (drop privs, standard workdir, manifests instead of dockerfile RUN args, standard labels, updated docs)