fix(security): run first-party scratch images as non-root UID 65532

CodeRabbit (PR review on #2494) flagged that the first-party scratch
images leave the container process running as root because no USER
directive is set. Adds the standard distroless nonroot UID/GID
65532:65532 just before ENTRYPOINT in seven first-party Dockerfiles.

The chosen UID matches gcr.io/distroless/static:nonroot and the
existing convention in the kubevirt-csi-driver and kamaji images.
Statically-linked Go binaries copied with default permissions remain
world-readable, so they execute fine under the non-root identity
without an extra chown step in the builder stage.

Touched:
- packages/system/backup-controller/images/backup-controller/Dockerfile
- packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile
- packages/system/cozystack-api/images/cozystack-api/Dockerfile
- packages/system/dashboard/images/token-proxy/Dockerfile
- packages/system/flux-plunger/images/flux-plunger/Dockerfile
- packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile
- packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile

Vendored Dockerfiles (kubevirt-cloud-provider, redis-operator,
keycloak-operator, linstor-csi, multus-cni, objectstorage,
s3manager, kamaji, cluster-autoscaler) are intentionally left
untouched — their runtime user choice is upstream's call.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

packages/system/backup-controller/images/backup-controller/Dockerfile

@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /backup-controller /backup-controller
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/backup-controller"]

packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile

@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /backupstrategy-controller /backupstrategy-controller
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/backupstrategy-controller"]

packages/system/cozystack-api/images/cozystack-api/Dockerfile

@@ -19,4 +19,5 @@ FROM scratch
 
 COPY --from=builder /cozystack-api /cozystack-api
 
+USER 65532:65532
 ENTRYPOINT ["/cozystack-api"]

packages/system/dashboard/images/token-proxy/Dockerfile

@@ -12,4 +12,5 @@ FROM scratch
 
 COPY --from=builder /token-proxy /token-proxy
 
+USER 65532:65532
 ENTRYPOINT ["/token-proxy"]

packages/system/flux-plunger/images/flux-plunger/Dockerfile

@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /flux-plunger /flux-plunger
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/flux-plunger"]

packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile

@@ -19,4 +19,5 @@ FROM scratch
 COPY --from=builder /kubeovn-plunger /kubeovn-plunger
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/kubeovn-plunger"]

packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile

@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /lineage-controller-webhook /lineage-controller-webhook
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/lineage-controller-webhook"]