fix(KFLUXBUGS-1666): Only analyze build context for dependencies

[arewm]

When generating the SBOM, we do not constrain the source analysis to the build context. This can result in many additional dependencies being included than should be.

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[rcerven]

/lgtm

[lcarva]

Is this safe? If the whole repo is available, doesn't that mean other parts could be used?

[arewm]

We run

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
          $VOLUME_MOUNTS \
          "${BUILDAH_ARGS[@]}" \
          "${LABELS[@]}" \
          --tls-verify=$TLSVERIFY --no-cache \
          --ulimit nofile=4096:4096 \
          -f "$dockerfile_path" -t $IMAGE .

This sets the working directory to ${SOURCE_CODE_DIR}/$CONTEXT so no other context should be available.

https://man7.org/linux/man-pages/man1/unshare.1.html

[arewm]

The remaining Checkton issues are flagged for untouched code. Marking this PR to merge when ready.