RHOAIENG-16517: chore(tests): add sandboxing so that Dockerfile builds can only access files we know they access

[jiridanek]

https://issues.redhat.com/browse/RHOAIENG-16517

Description

This(will be) important for OCP-CI and for Konflux, because there it is not possible to run the changed files detection up front, but instead the rules must be written into a .tekton directory (konflux) or in openshift/release (ocp-ci).

We must keep track of what files go into each image build, otherwise we cannot determine affected subset of images when testing a PR and would have to build everything.

How Has This Been Tested?

• trial build at https://github.com/opendatahub-io/notebooks/actions/runs/12275919093

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

[jstourac]

Okay, so basically - if our script bin/buildinputs if faulty, this will fail... we should be aware of this as this may cause us trouble in some cases. But effectively, we probably want to be aware of that, so good. It's just that this brings another step in our build workflow that can break somehow... but yeah, it's a good approach in general, I guess. Only workaround would be to make this configurable somehow (enabled by default) in cases we want to workaround something. What do you think?

/lgtm

[jiridanek]

/approve
this also increases disk space on /, so we want this sooner rather than later

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jiridanek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jiridanek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiridanek]

/override ci/prow/images

[openshift-ci]

@jiridanek: Overrode contexts on behalf of jiridanek: ci/prow/images

In response to this:

/override ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jiridanek]

@jstourac I like the override idea