Running pull_translations in k8s edxapp build causes permission errors for tracking log

[timmc-edx]

We have commented out make pull_translations in the edxapp public dockerfile because it causes deploy failures. This ticket is about finding an alternative approach that works.

Acceptance criteria:

• Translations built into docker image
• Deploys also work

Notes:

• The problem is that if we run make pull_translations as root in the Dockerfile, it write /var/tmp/tracking_logs.log (and possibly other files) as root, but it needs to be owned by app. However, running it as app fails, since it needs to write into the root-owned repo tree.
• Probably what we need to do is run it in a builder stage where we ADD the repo, pull translations, and then in another stage copy it into place. There are some details to think about in terms of whether we want to run as app or root (has implications for pycache files, which we could either precompile or remove).
• Might be worth seeing what Tutor does.

[timmc-edx]

Turns out /var/tmp/tracking_logs.log is present but owned as root on the failing pod, whereas it was owned by app on an older pod. Looks like make pull_translations runs as root and something it invokes is inadvertently creating a log file on startup.