feat: initial building of Arm64 container images

[p-]

• builds and publishes Docker container shell images for Arm64 as well (e.g. to be run on Apple Silicon/Cobalt/Graviton without emulation)
• with this change Docker images would be published for Amd64 and Arm64.
  (Debian images and relevant exist for Amd64 and Arm64 and tools that are currently downloaded like radare as well)

[Copilot]

Pull request overview

This PR updates the container build/publish pipeline to support producing and publishing Arm64 images, primarily by parameterizing derived-image base layers and switching builds to docker buildx with a per-architecture build matrix and a final multi-arch manifest publish step.

Changes:

• Parameterize derived container Dockerfiles with a BASE_IMAGE build-arg to allow arch-specific base selection.
• Refactor scripts/build_container_images.sh to use docker buildx build, support multiple tags, and optionally push images.
• Split the GitHub Actions workflow into per-arch build+push jobs and a manifest-combining publish job.

Show a summary per file

File	Description
src/seclab_taskflows/containers/sast/Dockerfile	Adds BASE_IMAGE build-arg to build from arch-specific base image.
src/seclab_taskflows/containers/network_analysis/Dockerfile	Adds BASE_IMAGE build-arg to build from arch-specific base image.
src/seclab_taskflows/containers/malware_analysis/Dockerfile	Adds BASE_IMAGE build-arg to build from arch-specific base image.
scripts/build_container_images.sh	Switches to docker buildx build, adds multi-tag/push support, and passes BASE_IMAGE to derived images.
.github/workflows/publish-container-images.yml	Builds/pushes per-arch images and then publishes multi-arch manifest lists.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (1)

scripts/build_container_images.sh:43

• docker buildx build does not always load the built image into the local Docker image store unless --load (or --push) is specified, depending on the active buildx driver. Since this script is intended for local builds as well as CI, add --load when PUSH!=1 to preserve the previous docker build behavior (and to ensure derived images can resolve the locally-built base image).

    if [[ "${PUSH}" == "1" ]]; then
        args+=(--push)
    fi
    echo "Building ${image}..."
    docker buildx build "${args[@]}" "$@" "${CONTAINERS_DIR}/${context}/"

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (1)

scripts/build_container_images.sh:46

• docker buildx build is invoked without --push or --load. When PUSH is left at its default (0), buildx will typically only populate the build cache and will not load the resulting images into the local Docker engine, breaking local usage of this script compared to the previous docker build -t ... behavior.

    if [[ "${PUSH}" == "1" ]]; then
        args+=(--push)
    fi
    echo "Building ${image}..."
    docker buildx build "${args[@]}" "$@" "${CONTAINERS_DIR}/${context}/"
}

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite