There's currently some confusion about which user to run dockerized `elastic-agent containers as. This has popped up in elastic/cloud-on-k8s#4794

We currently do create an elastic-agent user in the Dockerfile for agent, but since the docker agent isn't documented we have no established best practice here.

We also have two beats in conflict, Heartbeat does not allow script based monitors to run as the root user. This has created confusion for users who do want to run agent as a root user as in elastic/cloud-on-k8s#4794 . It seems that the main rationale for root is that metricbeat requires root for hostpath volumes, which are recommended against for security reasons. There may be other reasons for root I'm not aware.

So, we need to resolve these problems:

1. We need clear advice, either we tell users to run as root or not. If we do prefer root there's no need for the elastic-agent user.
2. We need to ensure that the choose made in 1. is secure. Since container root is not a 'real' root, AFAICT there's not a huge risk in running as UID 0 in a docker container. Esp. if the container daemon is set to run as a regular user (which is the best defense).
3. If running as non-root we have issues with setcap, as covered in [elastic-agent][heartbeat] Heartbeat binary should have setcap privs for ICMP ping #27651

Would appreciate thoughts from @ruflin @blakerouse and others.