work around issue with cryptography wheel in docker image

On the CFP host, docker builds were failing without this, due to missing rustc within the container. Cryptography's help docs suggest this as the first thing to try. Presumably newer python base images have newer pips anyway, so one day this should go away.

This now spits some warnings about running pip as root, but we're not really (inside a container anyhow)... so I think it's fine