add invoking user's group to docker containers

[mlin]

If a docker image has been baked with a USER directive to drop privileges to some arbitrary uid (a good security practice), then it may have trouble accessing the mounted working directory, which is owned by the user who invoked miniwdl. To support this we

1. add the invoking user's group to the container (a feature of Docker)
2. ensure everything miniwdl provisions in the working directory has group read/write permission

Incidentally add a gs:// downloader and a test script mirroring the "Getting Started" tutorial, adding which provoked the permissions change.

[coveralls]

Pull Request Test Coverage Report for Build 1323

• 84 of 86 (97.67%) changed or added relevant lines in 4 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.01%) to 96.866%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
WDL/_util.py	29	31	93.55%

Totals
Change from base Build 1315:	-0.01%
Covered Lines:	4698
Relevant Lines:	4850

---

💛 - Coveralls