Build the Go image from scratch instead of Debian #511

This repository builds the compute operator image from a static Go binary on a Debian-based distroless image, so a Debian CA or package update reaches production only through a rebuild. A scratch base carries nothing but the binary and the files copied in beside it, which drops the Debian packages the service never uses. The CA list then comes from a file this repository copies in, so it needs a named, current source. Time zone data and the non-root user have to be added the same way if the service uses them.

Success looks like

• Every image builds from scratch and passes this repository's tests and e2e
• The CA list comes from one named, current source that a root removal updates without a hand edit
• Every image runs as a non-root user, with time zone data where the service needs it

Related to datum-cloud/infra#7436