Use file permissions as per "server requirements" documentation

[GuySartorelli]

Currently apache is being run as runner:docker which gives it write access to everything in the project root.
Instead of this, we should adhere to (and amend if necessary) the permissions we say are necessary in the server requirements documentation.
This ensures both that the documentation is correct, and that we do not create regressions that make new permissions necessary.