feat(docker): switch to distroless

[zekth]

To avoid having security issues imported from many deps that alpine pulls, switching the docker image to distroless.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.92%. Comparing base (9d72b30) to head (3abd9e6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2164   +/-   ##
=======================================
  Coverage   35.92%   35.92%           
=======================================
  Files          82       82           
  Lines        7832     7832           
=======================================
  Hits         2814     2814           
  Misses       4753     4753           
  Partials      265      265           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Prashansa-K]

@harshadixit12 I have added a few changes to the original PR here. Please review.
Here's a gist of my changes:

• Updated the runtime base image from gcr.io/distroless/base to gcr.io/distroless/static-debian12:nonroot. distroless/base had pushed the final image size to 104 MB (36% larger than our current alpine based one). Both deck (CGO_ENABLED=0) and the bundled jq are statically linked, so the glibc base isn't needed. Moving to distroless/static brings the image down to 70.7 MB while keeping non-root and jq intact.
• I also set the HOME env variable as deck resolves $HOME on startup, and distroless has no shell/getent fallback. Adding a HOME explicitly here ensures that the binary doesn't panic in case a runtime leaves $HOME unset. This is less likely to happen but I erred on the side of caution.

Verified locally with podman: deck runs, jq works and the container runs as nonroot.

[zekth]

had pushed the final image size to 104 MB (36% larger than our current alpine based one)

thats not great :(