MLE-32900: Exclude UBI packages from Docker NOTICE scan

[vitalykorolev]

Description

Black Duck NOTICE scan of Docker images must exclude the UBI base and all
packages installed from UBI repositories, but not libnsl (Rocky rpm).

• Split dockerFiles/marklogic-deps-* into a platform stage (UBI base, all
  microdnf installs, FIPS policy) and a deps stage (adds the Rocky libnsl rpm).
• sudo moves into the platform stage for non-rootless types via
  PLATFORM_EXTRA_PACKAGES (empty for rootless images). The server Dockerfiles
  no longer install sudo or libcap.
• Makefile builds marklogic-platform- before the deps image.
• Jenkinsfile saves, loads and publishes marklogic-platform-:latest-
  (internal registry only) and passes it as BASE_IMAGE_TO_EXCLUDE to the Black Duck job.

Requires the companion securityscans PR (MLE-32900).

Checklist:

• Owner:

• JIRA_ID as part of branch/PR name

• Rebase the branch with upstream

• Squashed all commits into a single commit

• Added Tests

• Reviewer:

• Reviewed Tests

• Added to Release Wiki/Jira

[Copilot]

Copilot review overview

🟡 Changes recommended

Server templates still perform UBI package transactions outside the platform boundary, and the new exclusion behavior lacks automated coverage.

Review effort: Balanced
Findings: 4

Open (4)

• Add tests for platform boundaries and required package exclusions · New
• Eliminate rootless tzdata reinstall outside the platform boundary · New
• Move downstream tzdata reinstall into the platform stage · New
• Move downstream tzdata reinstall into the platform stage · New

What changed in this PR

Splits UBI-provided dependencies into a dedicated platform image for Black Duck NOTICE exclusions.

Changes:

• Adds platform/dependency Docker stages and relocates UBI packages.
• Builds, archives, publishes, and scans against platform images.
• Documents the new package-boundary convention.

File	Description
Makefile	Builds platform and dependency images.
Jenkinsfile	Publishes and supplies platform images to Black Duck.
dockerFiles/​marklogic-server-ubi9-arm:base	Inherits sudo from the platform.
dockerFiles/​marklogic-server-ubi:base	Inherits sudo from the platform.
dockerFiles/​marklogic-server-ubi-rootless:base	Inherits libcap from the platform.
dockerFiles/​marklogic-deps-ubi9:base	Adds UBI9 platform/deps stages.
dockerFiles/​marklogic-deps-ubi9-arm:base	Adds ARM platform/deps stages.
dockerFiles/​marklogic-deps-ubi:base	Adds UBI8 platform/deps stages.
.github/​copilot-instructions.md	Documents package-placement requirements.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Mutable asynchronous scan references can pair server and platform images from different concurrent builds.

Review effort: Balanced
Findings: 1

Open (1)

• Use immutable paired image references for asynchronous Black Duck scans · New

Resolved since last review (4)

• Move downstream tzdata reinstall into the platform stage
• Move downstream tzdata reinstall into the platform stage
• Eliminate rootless tzdata reinstall outside the platform boundary
• Add tests for platform boundaries and required package exclusions