fix: Konflux image for FIPS compliance (#89)

- update build+runtime images to stable hash, aligned to opendatahub-io/llm-d-router@97b3300
- runtime image contains updated OpenSSL libraries necessary for FIPS compliance
- make CGO_ENABLED=1 default
- add GOEXPERIMENT=strictfipsruntime to build

---
Signed-off-by: Edoardo Vacchi <evacchi@users.noreply.github.com>

Author: evacchi

docker/Dockerfile.apiserver.konflux

@@ -1,7 +1,7 @@
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.8@sha256:8c5aeac74b4b60dc2e5e44f6b639186b7ec2fec8f0eb9a36d4a32dcf8e255f52 AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
-ARG CGO_ENABLED=0
+ARG CGO_ENABLED=1
 
 WORKDIR /opt/app-root/src
 # Copy the Go Modules manifests
@@ -22,10 +22,9 @@ COPY pkg/ pkg/
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
 RUN mkdir -p bin && \
-    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -o bin/batch-gateway-apiserver ./cmd/apiserver
+    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOEXPERIMENT=strictfipsruntime go build -a -o bin/batch-gateway-apiserver ./cmd/apiserver
 
-# TODO: switch base image to gcr.io/distroless/static:nonroot before release
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7@sha256:d91be7cea9f03a757d69ad7fcdfcd7849dba820110e7980d5e2a1f46ed06ea3b
 WORKDIR /
 COPY --from=builder /opt/app-root/src/bin/batch-gateway-apiserver /app/batch-gateway-apiserver
 USER 1001:1001

docker/Dockerfile.gc.konflux

@@ -1,7 +1,7 @@
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.8@sha256:8c5aeac74b4b60dc2e5e44f6b639186b7ec2fec8f0eb9a36d4a32dcf8e255f52 AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
-ARG CGO_ENABLED=0
+ARG CGO_ENABLED=1
 
 WORKDIR /opt/app-root/src
 # Copy the Go Modules manifests
@@ -22,10 +22,9 @@ COPY pkg/ pkg/
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
 RUN mkdir -p bin && \
-    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -o bin/batch-gateway-gc ./cmd/batch-gc
+    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOEXPERIMENT=strictfipsruntime go build -a -o bin/batch-gateway-gc ./cmd/batch-gc
 
-# TODO: switch base image to gcr.io/distroless/static:nonroot before release
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7@sha256:d91be7cea9f03a757d69ad7fcdfcd7849dba820110e7980d5e2a1f46ed06ea3b
 WORKDIR /
 COPY --from=builder /opt/app-root/src/bin/batch-gateway-gc /app/batch-gateway-gc
 USER 1001:1001

docker/Dockerfile.processor.konflux

@@ -1,7 +1,7 @@
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.8@sha256:8c5aeac74b4b60dc2e5e44f6b639186b7ec2fec8f0eb9a36d4a32dcf8e255f52 AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
-ARG CGO_ENABLED=0
+ARG CGO_ENABLED=1
 
 WORKDIR /opt/app-root/src
 # Copy the Go Modules manifests
@@ -22,10 +22,9 @@ COPY pkg/ pkg/
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
 RUN mkdir -p bin && \
-    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -o bin/batch-gateway-processor ./cmd/batch-processor
+    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOEXPERIMENT=strictfipsruntime go build -a -o bin/batch-gateway-processor ./cmd/batch-processor
 
-# TODO: switch base image to gcr.io/distroless/static:nonroot before release
-FROM registry.access.redhat.com/ubi9/ubi-micro:latest
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7@sha256:d91be7cea9f03a757d69ad7fcdfcd7849dba820110e7980d5e2a1f46ed06ea3b
 WORKDIR /
 COPY --from=builder /opt/app-root/src/bin/batch-gateway-processor /app/batch-gateway-processor
 USER 1001:1001