Address phase 2 docker-up critical CVE findings

[geropl]

Summary

Implements Phase 2 of the CLC-2255 critical CVE remediation plan for components/docker-up:

• Rebuilds Docker Compose v2.40.3 from source during go generate, preserving the current Compose version while overriding vulnerable modules:
  • golang.org/x/crypto@v0.52.0
  • golang.org/x/net@v0.55.0
  • google.golang.org/grpc@v1.79.3
• Rebuilds runc from the existing v1.1.15 source line, preserving the major/minor/patch version while building with fixed golang.org/x/net@v0.55.0 and the current Go toolchain.
• Keeps runc seccomp support enabled during the rebuild.
• Removes the duplicate Docker Compose copy from the scratch image by copying only:
  • /usr/bin/docker-up
  • /usr/bin/runc-facade
  • /usr/local/bin/docker-compose
• Drops upstream Compose release provenance/SBOM sidecar handling because the Compose binary is now locally rebuilt rather than downloaded as an upstream release asset.

Issues

Relates to CLC-2255

Validation

• git diff --check
• bash -n components/docker-up/dependencies.sh
• leeway build components/docker-up:docker --dont-test -Dversion=dev -DimageRepoBase=localhost:5000/gitpod
• leeway sbom scan components/docker-up:docker --with-dependencies --output-dir /tmp/docker-up-phase2-final-scan -Dversion=dev -DimageRepoBase=localhost:5000/gitpod
  • components/docker-up:bin-docker-up: critical=0 high=43 ignored=1
  • components/docker-up:app: critical=0 high=39 ignored=1
  • components/docker-up:docker: critical=0 high=39 ignored=1
  • components/docker-up:bin-runc-facade: critical=0 high=6 ignored=0
  • components/common-go:lib: critical=0 high=0 ignored=0
  • components/scrubber:lib: critical=0 high=0 ignored=0
• docker run --rm 221a0d1b6b3551448cfca53f3a3d75b4b8ced8c3:latest /usr/local/bin/docker-compose version
  • Docker Compose version v2.40.3
• Confirmed /usr/bin/docker-compose is absent from the scratch image; container exits 127 for that path.

Notes

Phase 1 was merged in #21496 before this PR was opened, so this draft targets main directly.