Shell health checker is running as root

As the operator of an Aurora cluster, I have to guarantee that users can run commands only with the privileges of their role. The new health checker feature is risky in that regard, as it runs all health check commands with the privileges of the Thermos runner. In most common deployments this is root.

The Thermos runner supports various means for setting the uid/user/role that is used to run user processes. The same configuration should also apply to the user-defined health checking command.