feat: detect root users in Docker Compose services

[fusiontechstrategies]

Link to an issue, if relevant

Fixes #4036

Adding a new rule? Look over this PR checklist

• The issue has a reproduction and expected behavior
• The rule has true-positive and true-negative cases in a matching test file
• The message describes the condition, its risk, and a safer configuration

Summary

• Detect Docker Compose services whose direct user setting selects root or UID 0
• Cover quoted values and optional group identifiers
• Avoid findings for non-root users, interpolated users, root-only groups, nested extension settings, and service templates outside services

Validation

• New rule tests pass with Semgrep 1.176.0
• Full Docker Compose security-rule suite passes with Semgrep 1.169.0
• Rule configuration and metadata validation pass
• Repository pre-commit hooks pass in Linux
• Semgrep default ruleset reports zero findings in the rule definition
• Detect-secrets and Gitleaks report zero findings