[cmd/opampsupervisor] Specify requirements for privilege dropping

[evan-bradley]

Component(s)

cmd/opampsupervisor

Is your feature request related to a problem? Please describe.

Update the Supervisor design document to describe how to run the Collector as another user, which will generally be a user with lesser permissions.

Describe the solution you'd like

The current draft for the Supervisor's config file specifies the following config to run the Collector as different user:

collector:
  # Optional user name to drop the privileges to when running the
  # Collector process.
  run_as: myuser

Open questions:

1. Should this key be optional or required?
2. What mechanism should be used to accomplish this?
   One idea is to use a default tool (su, sudo, etc.) and provide an option for users to specify their own tool/script to run the Collector.

Describe alternatives you've considered

No response

Additional context

See this comment chain on the Google Doc for more context on the discussion so far.