ci(docker): use distroless/static base image

[kaiburjack]

Currently, the distroless/base image contains many things actually not needed by gcsproxy:

1. glibc: The distroless/base image has a full GNU C standard library implementation plus a dynamic linker loader and math libraries and charset conversion libraries, in case a binary program links dynamically against the GNU C library, which gcsproxy does not do. It currently also compiles without CGO, so the executable is fully static without any dynamic dependencies
2. OpenSSL: Go has its own crypto/tls TLS engine and does not make use of a system-wide OpenSSL installation
3. libzstd/libz: Go has its own compression/* packages

The only thing that gcsproxy actually needs from a base image is the CA root certificates for TLS/SSL server cert verification against the GCS API endpoint.

This almost halves the effective image size.

We also now pin the base image to make builds fully reproducible and make all updates deliberate using Dependabot.