Horusec: fix docker misconfiguration

[ErnestK]

What type of PR is this?

Bug fix

What does this PR do? Why is it needed?
After running the HorusEC tool on the Prysm repository,
several misconfigurations in Dockerfiles were detected (details provided below the spoiler).
This pull request aims to fix them

Running containers with 'root' user

Language: Generic
Severity: HIGH
Line: 0
Column: 0
SecurityTool: Trivy
Confidence: MEDIUM
File: /Users/.../prysm/.github/actions/gomodtidy/Dockerfile
Code: root user
Type: Vulnerability
ReferenceHash: 49099b0d2b0686ce3e0cb8e08691995be9ecca43fe18467fdf5ee1e28c8cdfaa
Details: (1/1) * Possible vulnerability detected: MissConfiguration
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    Message: Specify at least 1 USER command in Dockerfile with non-root user as argument
    Resolution: Add 'USER <non root user name>' line to the Dockerfile
    References: [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/ https://avd.aquasec.com/appshield/ds002]

You should use COPY instead of ADD

Language: Generic
Severity: LOW
Line: 0
Column: 0
SecurityTool: Trivy
Confidence: MEDIUM
File: /Users/.../prysm/tools/cross-toolchain/Dockerfile
Code: ADD instead of COPY
Type: Vulnerability
ReferenceHash: b6531b86d3c2ac67764225661d153d41192a48493ec90b1ca788cdca7828ca3f
Details: (1/4) * Possible vulnerability detected: MissConfiguration
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    Message: Consider using 'COPY common_osxcross.sh /tmp/common_osxcross.sh' command instead of 'ADD common_osxcross.sh /tmp/common_osxcross.sh'
    Resolution: Use COPY instead of ADD
    References: [https://docs.docker.com/engine/reference/builder/#add https://avd.aquasec.com/appshield/ds005]
       
(2/4) * Possible vulnerability detected: MissConfiguration
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    Message: Consider using 'COPY install_clang_cross.sh /tmp/install_clang_cross.sh' command instead of 'ADD install_clang_cross.sh /tmp/install_clang_cross.sh'
    Resolution: Use COPY instead of ADD
    References: [https://docs.docker.com/engine/reference/builder/#add https://avd.aquasec.com/appshield/ds005]
       
(3/4) * Possible vulnerability detected: MissConfiguration
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    Message: Consider using 'COPY install_osxcross.sh /tmp/install_osxcross.sh' command instead of 'ADD install_osxcross.sh /tmp/install_osxcross.sh'
    Resolution: Use COPY instead of ADD
    References: [https://docs.docker.com/engine/reference/builder/#add https://avd.aquasec.com/appshield/ds005]
       
(4/4) * Possible vulnerability detected: MissConfiguration
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    Message: Consider using 'COPY link_osxcross.sh /tmp/link_osxcross.sh' command instead of 'ADD link_osxcross.sh /tmp/link_osxcross.sh'
    Resolution: Use COPY instead of ADD
    References: [https://docs.docker.com/engine/reference/builder/#add https://avd.aquasec.com/appshield/ds005]

Which issues(s) does this PR fix?
fixes #13791

Other notes for review
This is an additional step for fixing all HorusEC vulnerabilities and a way to integrate HorusEC into CI.

[prestonvanloon]

This is failing this action now.

docker: Error response from daemon: unable to find user nonroot: no matching entries in passwd file.

[ErnestK]

@prestonvanloon fixed, re-review please

[prestonvanloon]

cp: can't create 'go.mod.orig': Permission denied

Please run CI locally using act