Disable VRT support in TiTiler by default

[batpad]

Due to potential issues with VRT files when using TiTiler (arbitrary file reading vulnerability reported in GDAL issue OSGeo/gdal#12645 and developmentseed/titiler#1180), we should disable it by default - we should be able to do this by setting some environment variables in the values.

cc @sunu @j08lue @pantierra @emmanuelmathot

[vincentsarago]

could we just create a user within the image which has no critical filesystem access?