Support Task/Step level user namespace remapping in `entrypoint`

One real challenge for Tekton adoption in environments concerned with security is that "many" images used for CI/CD run as "root". In many cases this is simply because images were not authored using the principle of least privilege but in others there are legitimate reasons why root is needed. Regardless, the net result is that running arbitrary images in your Tekton tasks requires caution and in some cases requires more draconian measures like permitting no root user.

There's a nice solution to the problem when running non-"privileged" images -- user namespace remapping. This is an approach offered in many container runtimes but sadly is still a WIP in Kubernetes -- https://github.com/kubernetes/enhancements/issues/127.

In Tekton we run an entrypoint binary in our steps so I wonder if we might look at doing the user namespace remapping (similar to what rootless buildkit does) there before we run the actual step payload. In this way we could have support now in Tekton and add userns-remap syntax to our taskrun or step specs now and when/if K8 offers support switch implementation.