Harden Container Runtime with Non-Root User

[MikeTheCyberGuy]

This PR makes the following changes:

• uses gcr.io/distroless/static-debian12 as the base image
• ensures the built containers are non-root users

In the process of working on this additional docker manifest updates were made:

• image_templates section was missing from the debug variant
• the top-level images should be the manifests and the tagged images should always be architecture specific (according to best practices)

Changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[spiffcs]

Running the checks on this now -- thank you for taking the time to improve the security posture of our images!
@anchore/tools do we want to offer these as new separate images or is worth the cost of breaking user pipelines here?

We might have to ensure file permissions are compatible here and set the user before the copy:
RUN chown -R nonroot:nonroot /tmp /syft /other-paths checking this now.

[wagoodman]

I refactored this to use the gcr.io/distroless/static-debian12 images directly, so QEMU is not needed (which is much simpler). The difference is that we're using the nonroot tags which should deal with the core issue more simply than needing our own security context stage.

[kzantow]

Hi @MikeTheCyberGuy 👋 -- due to a number of users having permission issues that were not obvious to workaround, we've reverted the nonroot-by-default (in latest tags), so the latest images are back to using root by default, however we've introduced a "nonroot" tag for users who want to run the nonroot variant; that is to say you will probably want to use anchore/syft:nonroot (and similar for Grype) for your purposes.