Dockerfile-workers: do more in build layer

Add RUN commands to the deps_base build layer to replace some commands
done in the runtime layer, and to be able to COPY some dirs with proper
ownership instead of having to tweak them in the runtime image.

docker/Dockerfile-workers

@@ -21,6 +21,15 @@ FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
       DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
           nginx-light
 
+    RUN \
+    # remove default page
+      rm /etc/nginx/sites-enabled/default && \
+    # have nginx log to stderr/out
+      ln -sf /dev/stdout /var/log/nginx/access.log && \
+      ln -sf /dev/stderr /var/log/nginx/error.log && \
+    # allow nginx user to write to http-*-temp-path dirs
+      chown www-data /var/lib/nginx
+
     # --link-mode=copy silences a warning as uv isn't able to do hardlinks between its cache
     # (mounted as --mount=type=cache) and the target directory.
     RUN --mount=type=cache,target=/root/.cache/uv \
@@ -46,13 +55,8 @@ FROM $FROM
     COPY --from=deps_base /usr/share/nginx /usr/share/nginx
     COPY --from=deps_base /usr/lib/nginx /usr/lib/nginx
     COPY --from=deps_base /etc/nginx /etc/nginx
-    RUN rm /etc/nginx/sites-enabled/default
-    RUN mkdir /var/log/nginx /var/lib/nginx
-    RUN chown www-data /var/lib/nginx
-
-    # have nginx log to stderr/out
-    RUN ln -sf /dev/stdout /var/log/nginx/access.log
-    RUN ln -sf /dev/stderr /var/log/nginx/error.log
+    COPY --from=deps_base /var/log/nginx /var/log/nginx
+    COPY --from=deps_base /var/lib/nginx /var/lib/nginx
 
     # Copy Synapse worker, nginx and supervisord configuration template files
     COPY ./docker/conf-workers/* /conf/