Use hadolint to lint Dockerfiles in CI

[jameslamb]

I discovered https://github.com/hadolint/hadolint tonight while looking at Apache Arrow (https://github.com/apache/arrow/blob/master/.hadolint.yaml).

It's a linter for Dockerfiles! We should use it on the Dockerfile(s) in this project.

[jameslamb]

I ran hadolint Dockerfile today, and it turned up a few things

Dockerfile:13 DL3018 Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
Dockerfile:27 DL4005 Use SHELL to change the default shell
Dockerfile:29 DL3013 Pin versions in pip. Instead of `pip install <package>` use `pip install <package>==<version>`
Dockerfile:41 DL3018 Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
Dockerfile:41 DL3019 Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages
Dockerfile:51 DL3018 Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
Dockerfile:51 DL4001 Either use Wget or Curl but not both
Dockerfile:51 DL4006 Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
Dockerfile:80 DL3003 Use WORKDIR to switch to a directory
Dockerfile:84 DL3003 Use WORKDIR to switch to a directory
Dockerfile:99 DL3025 Use arguments JSON notation for CMD and ENTRYPOINT arguments