[Distroless] Enable Distroless Java SDK based container images

[damondouglas]

Summary

Add distroless variants to existing Java SDK container images:

• beam-sdk/beam_java17_sdk
• beam-sdk/beam_java21_sdk

Description

The Publish Beam SDK Snapshots, and build_release_candidate GitHub workflows build and publish Beam container images using docker. The distroless base images by design lack tools assumed to exist in Java Dockerfiles such as file system tools. In order to reuse the existing Dockerfile to add a distroless variant, we need to employ a multi-stage build approach.

Blockers

• [Distroless] Enable BuildKit by default for container image builds #32819
• [Distroless] Enable optional multi-stage build support #32820

Measures of Done

• Add Java SDK Dockerfile distroless variants (PR: Enable Java SDK Distroless container image variants. #33173)
• [Distroless] GitHub workflow runs checks on Java SDK (non ML) distroless variants #33226
• [Distroless] Add ARM-based Distroless Java SDK variants #32899
• [Distroless] Publish Java SDK distroless variants #33201

[kennknowles]

How's the status here? I would love to cherry-pick changes if they are not risky, in order to offer users an option to get fewer vuln scanner results.