Fix Trivy DS-0002 and DS-0029 in Dockerfiles

DS-0002 (HIGH): run containers as a non-root user. Create an unprivileged
'appuser' and add a USER instruction to the action image (Dockerfile) and to
the dev/test stages (Dockerfile.dev). HOME is set so gh and tooling have a
writable home, and the entrypoint/report directories are chowned so the
non-root user retains read/execute access.

DS-0029 (HIGH): add --no-install-recommends to the apt-get install command in
both Dockerfiles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Claude Code Service

Dockerfile

@@ -4,7 +4,7 @@ FROM python:latest@sha256:6d58c1a9444bc2664f0fa20c43a592fcdb2698eb9a9c3225751653
 RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
     apt-get update --allow-releaseinfo-change && \
-    DEBIAN_FRONTEND="noninteractive" apt-get -yq install \
+    DEBIAN_FRONTEND="noninteractive" apt-get -yq install --no-install-recommends \
         bash \
         curl \
         jq \
@@ -18,4 +18,8 @@ COPY trivy_report /trivy_report
 
 RUN chmod +x /entrypoint.sh
 
+RUN useradd --create-home --uid 1001 --shell /bin/bash appuser
+ENV HOME=/home/appuser
+USER appuser
+
 ENTRYPOINT ["/entrypoint.sh"]

Dockerfile.dev

@@ -4,7 +4,7 @@ FROM python:latest AS base
 RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
     apt-get update --allow-releaseinfo-change && \
-    DEBIAN_FRONTEND="noninteractive" apt-get -yq install \
+    DEBIAN_FRONTEND="noninteractive" apt-get -yq install --no-install-recommends \
         bash \
         curl \
         jq \
@@ -13,6 +13,9 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
 
 ENV PYTHONPATH="/"
 
+RUN useradd --create-home --uid 1001 --shell /bin/bash appuser
+ENV HOME=/home/appuser
+
 FROM base AS dev
 
 COPY ./requirements.txt /
@@ -25,7 +28,10 @@ COPY ./bin/print_issues /docker/print_issues
 COPY ./trivy_report /trivy_report
 COPY ./tests/ /tests/
 
-RUN chmod +x /docker/*
+RUN chmod +x /docker/* && \
+    chown -R appuser /docker /tests /trivy_report
+
+USER appuser
 
 ENTRYPOINT ["/docker/print_issues"]