cc: #565, #568

Fixes: #565

Also, split Dockerfile into two stages, so rust
and other build dependencies don't end up in the final image.

Note cryptography has binary wheels for various architectures,
but unfortunately not for 32-bit arm. And, starting from v35.0.0,
cryptography requires rust to build from source.

Bullseye isn't currently supported on the Pi 4

This massively reduces the size of the final container