fix(security): migrate to scratch runtime image and update vulnerable dependencies - #79

Do not merge this PR, before we verified in QA that this version is working as expected in QA.

We use the image produced by the PR pipeline to deploy this version to QA.

Merging this branch will increase overall coverage

Verification: binary rule == script rule

The goal is to confirm that internal/firewall installs the same effective nftables match as the iptables-nft init-container script did.

Prerequisites

A root shell on the target node. Either:

# node-level shell (host filesystem at /host)
kubectl debug node/<node-name> -it  --profile=sysadmin --image=ubuntu -- chroot /host bash

or a privileged pod. The binary's pod is hostNetwork: true / privileged: true, so the rules land directly in the node's nftables.

Step 1 — deploy this PR and capture what the binary installs

After rollout:

sudo nft list table ip pmtud

Expected output:

table ip pmtud {
    chain prerouting {
        type filter hook prerouting priority raw; policy accept;
        iifname "<iface>" meta l4proto icmp icmp type destination-unreachable icmp code frag-needed log group <N>
    }
}

What to compare

The table name difference is intentional (design decision: clean lifecycle ownership). All match semantics and the hook/priority position are identical.

Step 2 — verify teardown is clean

After the pod is deleted/restarted the table must be gone:

sudo nft list tables | grep pmtud   # should print nothing

Step 3 — Use Metrics to Validate Packet arrival

sum(rate(go_pmtud_recv_packets_total[5m])) — proves nflog group still receives packets ([L92 in pmtud.go](https://github.com/sapcc/go-pmtud/blob/master/internal/nflog/pmtud.go#L92))
sum(rate(go_pmtud_sent_packets_total[5m])) — proves packets are forwarded to each peer ([L145 in pmtud.go](https://github.com/sapcc/go-pmtud/blob/master/internal/nflog/pmtud.go#L145))
rate(go_pmtud_error_total[5m]) — no new errors

No stale rules accumulate across pod restarts — that was the original bug this PR fixes.