Fixes for VAT findings

Since the final container is based on a new image, the ownership of /usr/local/apache2 is left dangling with no true ownership. The php base image user:group is not carried over. Some docs are being flagged for encryption keys, but they are examples and unuseful keys, let's just remove them.