feat: avoid large copy into runtime image

This MR removes the many COPYs from the builder to runtime image, which make it hard to reuse the default environment layer and causes large downloads.

The container is now built with two parallel tracks: one builder and one runtime.

## This docker build follows two tracks, in order to ensure that we build all packages
## in a builder image, but install them in a runtime image, while at the same time
## avoiding a expensive filesystem copy operation at the end that breaks layering.
##
## The build is split in an infrequently-changing default environment, upon which
## an environment with custom versions (e.g. individual commits) is layered. The
## custom environment will change frequently but layers will be smaller, allowing
## for easier deployment with smaller delta layers.
##
## The separation in a builder and runtime image is particularly relevant to end up with
## lightweight images for expensive build dependencies, such as for example CUDA.
##
## builder track                         runtime track
## ----------------------------------------------------------------------
## builder_image                         runtime_image
## builder_concretization_default   
## builder_installation_default     ->   runtime_concretization_default  (copy spack.lock)
##                                 \->   runtime_installation_default    (from buildcache)
## builder_concretization_custom
## builder_installation_custom      ->   runtime_concretization_custom   (copy spack.lock)
##                                 \->   runtime_installation_custom     (from buildcache)