Fix overlay file ownerships

By default, `tar` copies file ownership UID/GID.  This works fine when
the build is running in a rootless container, since the source UID/GID
numbers are mapped to 0/0 inside the container.  In other scenarios,
though, such as building in a microvm with the source directory on a
shared filesystem, the original numbers are preserved.  We need to
explicitly state that the files must be owned by root.

build-rootfs.sh

@@ -59,8 +59,8 @@ while read name; do
     fi
 done < busybox.symlinks
 
-tar -c -C overlay . \
-    | tar -x --keep-newer-files -C /mnt/gentoo
+tar -c -C overlay --owner=root --group=root . \
+    | tar -x -C /mnt/gentoo
 
 cp -uv /usr/${target}/usr/bin/grub-editenv /mnt/gentoo/usr/bin/