[Distroless] Enable Distroless Python SDK (non-ML) based container

[damondouglas]

Summary

Add distroless variants to existing Python SDK container images:

• beam-sdk/beam_python3.9_sdk
• beam-sdk/beam_python3.10_sdk
• beam-sdk/beam_python3.11_sdk
• beam-sdk/beam_python3.12_sdk

Description

The Publish Beam SDK Snapshots, PreCommit Python Docker, and build_release_candidate GitHub workflows build and publish Beam container images using docker. The distroless base images by design lack tools assumed to exist in Python Dockerfiles such as pip, and many file system tools. In order to reuse the existing Dockerfile to add a distroless variant, we need to employ a multi-stage build approach.

Blockers

• [Distroless] Enable BuildKit by default for container image builds #32819
• [Distroless] Enable optional multi-stage build support #32820

Measures of Done

• Refactor Python SDK Dockerfile to add distroless variants
• Gradle :docker tasks can build existing non-distroless Python SDK variants and new distroless for specified Python versions
• [Distroless] Add ARM-based Distroless Python SDK (non-ML) variants #32898
• [Distroless] Publish Python distroless variants #32914
• [Distroless] GitHub workflow runs checks on Python SDK (non ML) distroless variants #33003
• [Distroless] Fix Python SDK (non ML) image scan results CVE-2023-45853 #33004
• [Distroless] Fix Python SDK (non ML) image scan results CVE-2023-52425 #33005