Harden the docker image

[tarekziade]

Closes https://github.com/elastic/enterprise-search-team/issues/4576

see https://github.com/OWASP/Docker-Security/blob/main/D00%20-%20Overview.md

• [ ] D01 - Secure User Mapping [WONTDO]
• [ ] D02 - Patch Management Strategy [ACK]
• [x] D03 - Network Segmentation and Firewalling -- we expose the bare minimal and the image does not call external stuff
• [x] D04 - Secure Defaults and Hardening -- we use --no-cache and install the bare minimun
• [x] D05 - Maintain Security Contexts -- same justification as D03
• [x] D06 - Protect Secrets -- no secrets used
• [ ] D07 - Resource Protection
• [x] D08 - Container Image Integrity and Origin -- openresty can be trusted
• [ ] D09 - Follow Immutable Paradigm [WONTDO] -- we need to share a volume
• [ ] D10 - Logging

Checklists

Pre-Review Checklist

• [x] this PR has a meaningful title
• [x] this PR links to all relevant github issues that it fixes or partially addresses
• [ ] if there is no GH issue, please create it. Each PR should have a link to an issue
• [ ] this PR has a thorough description
• [ ] Covered the changes with automated tests
• [ ] Tested the changes locally
• [ ] Added a label for each target release version (example: v7.13.2, v7.14.0, v8.0.0)
• [ ] Considered corresponding documentation changes
• [ ] Contributed any configuration settings changes to the configuration reference

Changes Requiring Extra Attention

• [ ] Security-related changes (encryption, TLS, SSRF, etc)
• [ ] New external service dependencies added.

Related Pull Requests

Release Note