The --link flag is a feature of Docker BuildKit which tells Docker to
treat the COPY'd layer independently of previous layers, enabling more
aggressive build caching. For more details, see this Docker blog post [1].
When using COPY --link to copy files from a stage that does not contain
/etc/passwd, we must --chown with $APP_USER_ID rather than app.
Otherwise, the build would fail with "unknown user id".
[1] https://www.docker.com/blog/image-rebase-and-improved-remote-cache-support-in-new-buildkit/
