fix: [CI-21185]: Upgrade Go to 1.25.7 and run as non-root user (#51)

Security fixes:
1. Upgrade Go from 1.25 to 1.25.7 to fix critical CVEs:
   - CVE-2025-68121 (critical, CVSS 10.0) - crypto/tls session resumption issue
   - CVE-2025-61726 (high, CVSS 7.5) - net/url query parameter limit
   - CVE-2025-61730 (medium, CVSS 5.3) - crypto/tls handshake boundary issue

2. Run container as non-root user (uid:gid 65534:65534):
   - Added USER directive to run as nobody:nobody
   - Copied /etc/passwd for user resolution
   - Prevents privilege escalation and improves container security

Changes:
- Updated base image: golang:1.25-alpine3.21 → golang:1.25.7
- Changed from apk (alpine) to apt-get (debian) for Go 1.25.7 image
- Added non-root user configuration in final scratch image

Tested:
- Binary builds successfully
- --version flag works: returns build version
- Non-root user (65534:65534) enforced
- Permission restrictions validated

Author: spahuja-harness

docker/Dockerfile-plugin

@@ -1,9 +1,11 @@
 # ---------------------------------------------------------#
 #                   Build Plugin Binary                    #
 # ---------------------------------------------------------#
-FROM us-west1-docker.pkg.dev/gar-setup/docker/golang:1.25-alpine3.21 as builder
+FROM us-west1-docker.pkg.dev/gar-setup/docker/golang:1.25.7 as builder
 
-RUN apk add --no-cache git ca-certificates
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates git && \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -44,12 +46,18 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # ---------------------------------------------------------#
 FROM scratch
 
+# Copy minimal passwd file for non-root user
+COPY --from=builder /etc/passwd /etc/passwd
+
 WORKDIR /binaries
 
 # Copy the binary (handle both Linux/macOS and Windows)
 ARG TARGETOS
 COPY --from=builder /app/plugin* /binaries/
 
+# Run as non-root user (nobody:nobody is typically uid:gid 65534:65534)
+USER 65534:65534
+
 # Build metadata labels
 ARG BUILD_VERSION
 ARG BUILD_TIME