test(container): assert OCI Config.User is unset in static-image checks

[christopherco]

Add a shared static-image-checks test that fails if a container image's
OCI manifest declares an explicit Config.User (e.g. user="root" in the
kiwi ). An explicit user diverges from the unset default
used by AZL 3.0 and mainstream base images.

• conftest: new session fixture oci_image_config returning the parsed
  skopeo inspect --config output.
• extract: inspect_oci_config() helper using skopeo inspect --config
  (skopeo is already a declared container tool; no umoci needed).
• cases/test_oci_config.py: shared test gated on the container
  capability via @pytest.mark.require_capability("container") (matching
  the existing test_packages.py convention) so it runs for every
  container image family and skips VM images. Asserts User is absent
  from the OCI config (an explicit empty string also fails).
• images.toml: wire the three distroless images into static-image-checks
  with a container = true capability table so the new test covers them
  (package tests correctly skip — no runtime-package-management).

Fixes: AB#20622

[christopherco]

Corresponding OCI test fixtures and static test for #17619

[Copilot]

Pull request overview

Adds a shared static-image-checks assertion for Azure Linux container images to ensure OCI config.User is not explicitly set, aligning container image metadata with AZL 3.0 and common base-image conventions. This expands the static test suite coverage to distroless container images and introduces a small helper to inspect OCI config without unpacking.

Changes:

• Add inspect_oci_config() helper that runs skopeo inspect --config and parses the OCI config JSON.
• Add a session-scoped oci_image_config fixture (container-only; cleanly skips for VM images) and a shared test validating Config.User is absent.
• Wire distroless container images into static-image-checks and declare container capabilities (including runtime-package-management = false).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
base/images/tests/utils/extract.py	Adds inspect_oci_config() helper to fetch OCI config JSON via skopeo.
base/images/tests/README.md	Documents the new shared container test and the oci_image_config fixture.
base/images/tests/conftest.py	Adds oci_image_config session fixture gated by image_type.
base/images/tests/cases/test_oci_config.py	Introduces shared test asserting OCI config.User key is absent.
base/images/images.toml	Enables static-image-checks and capability declarations for distroless container images.

[reubeno]

Love the idea of the test! A couple of quick comments.

[reubeno]

Thanks for the metadata updates here; their omission on the distroless containers was an oversight.

[reubeno]

Should use a marker, e.g.: @pytest.mark.require_capability with an appropriate capability if there is one.

[christopherco]

Added the container capability