docker: Don't use a hardcoded root password
    
    Best practice is to use unprivileged service daemons inside Docker
    containers.  But with this hardcoded root password, in the case of
    remote code execution, an attacker could trivially escalate their
    privileges to root/uid 0.  And while that's uid 0 inside a container,
    that's a much larger attack surface.
    
    Instead, do the same thing we're doing for the Cloud images: lock the
    root password, create a user to make Anaconda happy, then delete the
    user in %post.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1175997