feat(art-cluster): add BuildConfig for rpm-lockfile-prototype image

Add ImageStream, BuildConfig, and ServiceAccount+RoleBinding to build
and serve the rpm-lockfile-prototype container image from art-cluster.

- Containerfile: Fedora base with python3-dnf, skopeo, RH IT CA certs
- BuildConfig outputs to ImageStreamTag rpm-lockfile-prototype:v0.23.0
- ServiceAccount rpm-lockfile-image-puller for Jenkins pull access

After deployment, generate a pull token:
  oc create token rpm-lockfile-image-puller -n art-cd --duration=8760h

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED

Author: fgallott

art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yaml

@@ -0,0 +1,26 @@
+apiVersion: build.openshift.io/v1
+kind: BuildConfig
+metadata:
+  labels:
+    build: rpm-lockfile-prototype
+  name: rpm-lockfile-prototype
+spec:
+  source:
+    dockerfile: art-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototype
+    git:
+      ref: main
+      uri: https://github.com/openshift-eng/art-tools
+    type: Git
+  strategy:
+    dockerStrategy:
+      dockerfilePath: art-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototype
+      pullSecret:
+        name: art-bot-docker-config
+    type: Docker
+  output:
+    to:
+      kind: ImageStreamTag
+      name: rpm-lockfile-prototype:v0.23.0
+  successfulBuildsHistoryLimit: 10
+  failedBuildsHistoryLimit: 5
+  runPolicy: Serial

art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_image.yaml

@@ -0,0 +1,4 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: rpm-lockfile-prototype

art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_pull_access.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rpm-lockfile-image-puller
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: rpm-lockfile-image-puller-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:image-puller
+subjects:
+  - kind: ServiceAccount
+    name: rpm-lockfile-image-puller
+    namespace: art-cd

art-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototype

@@ -0,0 +1,21 @@
+ARG BASE_IMAGE=registry.fedoraproject.org/fedora:latest
+
+FROM ${BASE_IMAGE}
+RUN dnf install -y python3 python3-pip python3-dnf skopeo rpm git-core && dnf clean all
+
+# Install RH IT CA bundle so DNF can reach internal repos (rhsm-pulp.corp.redhat.com)
+RUN curl -sko /etc/pki/ca-trust/source/anchors/2022-IT-Root-CA.pem \
+        https://certs.corp.redhat.com/certs/2022-IT-Root-CA.pem && \
+    curl -sko /etc/pki/ca-trust/source/anchors/2015-IT-Root-CA.pem \
+        https://certs.corp.redhat.com/certs/2015-IT-Root-CA.pem && \
+    update-ca-trust
+
+WORKDIR /app
+
+ARG GIT_REF=tags/v0.23.0
+
+RUN python3 -m pip install https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/${GIT_REF}.tar.gz
+
+WORKDIR /work
+
+ENTRYPOINT ["/usr/local/bin/rpm-lockfile-prototype"]