Publish "dummy" application image

Added:
- Publish application as "dummy" image
- authz_by_groups now gets memberships from configuration
- Updated routing where "/" is not authenticated but "/login" is, for
  applications where unauthenticated but reduced access is permitted

Updated:
- Use pdoc instead of pdoc3

Fixed:
- Use of SQLite database no longer tests instance directory
  unnecessarily
- Entitlement logic now grants all entitlements, not just the first
  possible