The `r` channel has been considered part of `defaults` since `conda` version `4.3.0`. So it should already be taken into consideration by `conda` installs without having to explicitly add the channel. Further the `conda-forge` channel has incorporated an ever growing, healthy stack of R packages. As such it appears all of the R packages used in this stack now come from `conda-forge` and not `defaults`. Given all of this, it seems safe to drop the `r` channel from explicit addition to the channel list.
- any files the user should be able to write should have group `user-permissions` with `g+rwX`
- remove `chown` from start.sh because it is no longer needed
- add `fix-permissions` script for setting the user-writable permissions on a path
- user-permissions group as GID 10000 (is there a reason for it to have a different value?)
- containers can set group with `--group-add user-writable` if they want to run with a different uid/gid
(without -u root -e NB_UID -e NB_GID, which make this unnecessary)
- add a few missing `--system` flags to conda config
- install default notebook config to /etc/jupyter instead of ~/.jupyter
- add a few missing `conda clean`s
* Upgrade to latest debian base image
* Upgrade to Notebook 4.3
* Upgrade to Miniconda 4.2.12
* Remove USE_HTTPS env var in favor of command line options for key and cert
* Add GEN_CERT env var for generating a self-signed certificate
* Remove PASSWORD env var in favor of the new Notebook 4.3 default token auth
or the more secure a hashed password command line option
As per [their blog post of the 27th April](https://blog.readthedocs.com/securing-subdomains/) ‘Securing subdomains’:
> Starting today, Read the Docs will start hosting projects from subdomains on the domain readthedocs.io, instead of on readthedocs.org. This change addresses some security concerns around site cookies while hosting user generated data on the same domain as our dashboard.
Test Plan: Manually visited all the links I’ve modified.
