It's using a stable version of Debian, so it's redundant to lock
packages to specific versions.

Get some of the NsJail build dependencies pre-installed thanks to the
base image.

Separate snekbox's Python interpreter from the interpreter used by
NsJail. This allows for the interpreters to be updated on different
cadences and provides better isolation of packages.

Each Python interpreter adds about 70 MB to the built image.

Re-use already built COPY layers in subsequent builds even if the
previous layers have changed, which is especially helpful when copying
from another build stage.

See https://docs.docker.com/engine/reference/builder/#copy---link

Prevent an empty exec_bin.args from manifesting as an empty string in
the fully built arguments.

Need to use `export` to set vars when && is used between the commands.

Due to the way that `find` executes -exec arguments we need to
run the pip install's inside another `sh` instance so that the
PYTHONUSERBASE environment variable is correctly picked up.

Additionally, we need to specify `--user` so that pip respects
the PYTHONUSERBASE variable at all.