Update OPA images to use non-root uid/gid by default

Currently all OPA image variants except "rootless" use
uid/gid 0 (i.e. root). Per container security best
practices it is better to run as non-root. So now OPA
defaults to non-root uid/gid in images. If root user
if needed, it can be explicitly set.

The "rootless" image variant is no longer needed and
will be not published in future releases.

Also currently the debug variant is published
for `linux/amd64` platform. For `linux/arm64` only static
images are generated. The debug variant can be useful
for debugging purposes and hence this change adds that
to the static image which can then be used on amd64 and arm64 arch.

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>

Dockerfile

@@ -9,16 +9,17 @@ FROM ${BASE}
 LABEL org.opencontainers.image.authors="Torin Sandall <torinsandall@gmail.com>"
 LABEL org.opencontainers.image.source="https://github.com/open-policy-agent/opa"
 
+
 # Temporarily allow us to identify whether running from within an offical
-# Docker image, so that we may print a warning when uid or gid == 0 (root)
-# Remove once https://github.com/open-policy-agent/opa/issues/4295 is done
-ENV OPA_DOCKER_IMAGE="official"
+# Docker image with a "rootless" tag, so that we may print a warning that this image tag
+# will not be published after 0.50.0. Remove after 0.50.0 release.
+ARG OPA_DOCKER_IMAGE_TAG
+ENV OPA_DOCKER_IMAGE_TAG=${OPA_DOCKER_IMAGE_TAG}
 
 # Any non-zero number will do, and unfortunately a named user will not, as k8s
 # pod securityContext runAsNonRoot can't resolve the user ID:
-# https://github.com/kubernetes/kubernetes/issues/40958. Make root (uid 0) when
-# not specified.
-ARG USER=0
+# https://github.com/kubernetes/kubernetes/issues/40958.
+ARG USER=1000:1000
 USER ${USER}
 
 # TARGETOS and TARGETARCH are automatic platform args injected by BuildKit