fix(cve): dist-upgrade base OS packages in the fat linstor images

The spaas, drbd-reactor, metadata-backup and linstor-server final images are
built from the Alt builder and ship a full OS, so Trivy flags their base
packages (curl, etc. — CRITICAL/HIGH ALT advisories). Add
`apt-get -y dist-upgrade` after the existing `apt-get update` in each final
stage to pull the security-patched packages from the Alt P11 repo.

Signed-off-by: v.oleynikov <vasily.oleynikov@flant.com>

Author: duckhawk

images/drbd-reactor/werf.inc.yaml

@@ -189,6 +189,7 @@ shell:
     - export DEBIAN_FRONTEND=noninteractive
     - |
       apt-get update \
+      && apt-get -y dist-upgrade \
       && apt-get -y install libkeyutils kmod sysklogd
     - {{ $.Root.ALT_CLEANUP_CMD }}
   setup:

images/linstor-server/werf.inc.yaml

@@ -298,6 +298,7 @@ shell:
     # Enable contrib repos for zfsutils
     - sed -r -i 's/^deb(.*)$/deb\1 contrib/' /etc/apt/sources.list
     - echo "Update packages list..." && apt-get update
+    - echo "Upgrade base OS packages for CVE fixes..." && apt-get -y dist-upgrade
 
     # install our own RPM packages first
     - |

images/metadata-backup/werf.inc.yaml

@@ -10,6 +10,7 @@ git:
 shell:
   beforeInstall:
     - apt-get update
+    - apt-get -y dist-upgrade
     - DEBIAN_FRONTEND=noninteractive apt-get install -y wget unzip git python3 python3-module-pip jq curl gettext-base util-linux vim-console
     - pip3 install kubernetes==30.1.0 urllib3==2.6.0
   setup:

images/spaas/werf.inc.yaml

@@ -45,6 +45,7 @@ shell:
     - export DEBIAN_FRONTEND=noninteractive
     - |
       apt-get update \
+      && apt-get -y dist-upgrade \
       && apt-get -y install build-essential gcc glibc make coccinelle python3-dev vim-console \
       && apt-get -y install ca-certificates \
       && update-ca-trust \