Controlled apt

[ferdnyc]

This PR contains changes to mitigate the issues updating / running apt in the container, as discussed in #33.

It turns out that running arbitrary scripts using os.system() works... not so well, in practice. So, this PR moves to a more controlled method of managing the container's packages, with two new with: options added to the action syntax:

- uses: ammaraskar/sphinx-action:master
  with:
    update: (true/false, defaults 'false' unless 'install' is set)
    install: >-
      a
      list
      of apt packages
      to install
    docs-folder: docs/

The added logic goes:

1. If either 'update' or 'install' is set, update apt with

   subprocess.call(["/usr/bin/apt", "-y", "update"])

2. Collect the list of packages from 'install'. (actions.yml doesn't take yaml sequences directly, but the funky >- syntax tells it to fold newlines into spaces and present the results as a single space-separated list.)
3. If the list is non-empty, install them with

   subprocess.call(["/usr/bin/apt", "-y", "install", *packages])

The PR also makes two other changes:

• Builds the container from sphinxdoc/sphinx:latest, because 2.4.4 is ancient which is part of the problem. (If people have concerns about tracking a moving-target like latest, the current is 4.3.2 and would be a better choice than 2.4.4.)
• Makes the Python process that runs entrypoint.py unbuffered via #!/usr/bin/env -S python3 -u, so that the output of print() calls and subcommands is more correctly interleaved.

Fixes #33 #32