chore(docker): restructure conditional RUN blocks as heredocs

- Addresses review feedback on #186
- Redo profile-fetch and cache-warm RUN commands as BuildKit
heredocs
- Added set -e to keep old && failure semantics - proposed heredoc blocks would only report exit status of its last command

Author: alexhambley

Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 FROM python:3.11-slim
 
 # git is needed by some dependencies; wget is only used when baking a profile.
@@ -22,24 +23,30 @@ ARG FIVE_SAFES_PROFILE_VERSION=""
 ARG EXTRA_PROFILES_PATH=""
 ENV EXTRA_PROFILES_PATH=${EXTRA_PROFILES_PATH}
 ENV CACHE_PATH=/app/.rocrate-cache
-RUN if [ -n "$PROFILES_ARCHIVE_URL" ]; then \
-        mkdir -p /app/extra-profiles && \
-        wget -O /tmp/profiles.tar.gz "$PROFILES_ARCHIVE_URL" && \
-        tar -xzf /tmp/profiles.tar.gz \
-            -C /app/extra-profiles \
-            --strip-components=3 \
-            "rocrate-validator-${FIVE_SAFES_PROFILE_VERSION}/rocrate_validator/profiles/five-safes-crate" && \
-        rm /tmp/profiles.tar.gz ; \
-    fi
+RUN <<EOF_PROFILES
+set -e
+if [ -n "$PROFILES_ARCHIVE_URL" ]; then
+    mkdir -p /app/extra-profiles
+    wget -O /tmp/profiles.tar.gz "$PROFILES_ARCHIVE_URL"
+    tar -xzf /tmp/profiles.tar.gz \
+        -C /app/extra-profiles \
+        --strip-components=3 \
+        "rocrate-validator-${FIVE_SAFES_PROFILE_VERSION}/rocrate_validator/profiles/five-safes-crate"
+    rm /tmp/profiles.tar.gz
+fi
+EOF_PROFILES
 
 # Pre-populate the HTTP cache so opt-in offline validation
 # (VALIDATION_OFFLINE=true) works without network at runtime.
-RUN if [ -n "$EXTRA_PROFILES_PATH" ]; then \
-        rocrate-validator cache warm --all-profiles \
-            --extra-profiles-path "$EXTRA_PROFILES_PATH" --cache-path "$CACHE_PATH" ; \
-    else \
-        rocrate-validator cache warm --all-profiles --cache-path "$CACHE_PATH" ; \
-    fi
+RUN <<EOF_CACHE_WARM
+set -e
+if [ -n "$EXTRA_PROFILES_PATH" ]; then
+    rocrate-validator cache warm --all-profiles \
+        --extra-profiles-path "$EXTRA_PROFILES_PATH" --cache-path "$CACHE_PATH"
+else
+    rocrate-validator cache warm --all-profiles --cache-path "$CACHE_PATH"
+fi
+EOF_CACHE_WARM
 
 RUN useradd -ms /bin/bash flaskuser
 RUN chown -R flaskuser:flaskuser /app