feat(paseo): give the paseo user sudo, authenticated with PASEO_PASSWORD

The base image installs no sudo and leaves paseo out of the sudo group, so
add both. The password cannot be baked in at build time -- it is a secret and
would land in a layer -- and it cannot be set after the base entrypoint, which
ends in `exec gosu paseo` and never returns. Wrap that entrypoint instead and
set the password while still root, on every start: /etc/shadow lives in the
image, not on the /home/paseo volume, so it reverts on each recreate.

paseo/.env.example

@@ -2,7 +2,8 @@
 #
 #   cp .env.example .env
 
-# Password for the daemon API and web UI.
+# Password for the daemon API and web UI. Doubles as the paseo user's login
+# password, so it is also what `sudo` asks for inside a terminal.
 # Generate one with: openssl rand -base64 24
 PASEO_PASSWORD=