feat: migrate to fully distroless ocm image

[jakobmoellerdev]

What this PR does / why we need it

Migrates to Distroless which has a few advantages over alpine:

1. Smaller Base Image
2. No Package Manager or Shell that could be used to exploit vulnerabilities
3. Non-Root user by default

I also remove the latest check in alpine since it only fetched a tag anyhow and we should pin by digest

Which issue(s) this PR fixes

[hilmarf]

What about: https://github.com/open-component-model/ocm/blob/main/Dockerfile ? Shouldn't we change that one as well?

[jakobmoellerdev]

In addition to this PR, longterm I want to completely get rid of the component based dockerfile and switch to a central one so that everyone can use docker build instead of 2 dockerfiles that differ in the build process. But I want to split this into a separate one, so for now, this should suffice

[frewilhelm]

Please adjust COPY go.mod go.sum *.go VERSION ./ to COPY go.mod go.sum ./ in ./Dockerfile

[frewilhelm]

Overall the changes lgtm. However, we should discuss component/ocmcli/Makefile and its Dockerfile (as you already proposed).

[jakobmoellerdev]

not to be merged until @hilmarf explicitly approves due to cross dependency to piper step