Update internal repo to support non-root user scenario

Related to: https://github.com/Azure/data-api-builder/issues/3514

## Background

Public PR Azure/data-api-builder#3520 restructured the sample `Dockerfile` into a multi-target build with two runtime variants:

- `runtime` (default / last stage) — runs as **root**, backwards-compatible with today's published image.
- `runtime-nonroot` (opt-in via `--target runtime-nonroot`) — runs as `USER $APP_UID` (UID 1654), satisfies scanners (e.g. Checkmarx One) that require a non-root `Config.User`.

The public `Dockerfile` is only a customer sample. The image we actually publish is built from the **internal repo**, which has its own `Dockerfile` + release pipeline YAML — both need updating to publish the second tag.

## Tasks

- [ ] Update the internal `Dockerfile` to match #3520 (multi-stage `runtime-base` → `runtime` / `runtime-nonroot`, `USER $APP_UID`, non-recursive `chown $APP_UID:$APP_UID /App/logs`).
- [ ] Update the pipeline to build + push **both** images: root (`:`, `:latest`) and non-root (`--target runtime-nonroot` → `:-nonroot`, `:latest-nonroot`).
- [ ] Run signing, SBOM/manifest, and registry push for both tags.
- [ ] Point the container scan gate at the `-nonroot` image.
- [ ] Update release notes / image README with the two variants and non-root consumer caveats.

Beginne damit, die interne Dockerfile und das Release-Pipeline-YAML mit den Änderungen in öffentlichen PR #3520 zu vergleichen. Fertig ist die Arbeit, wenn sowohl Root- als auch Non-Root-Tags gebaut, signiert und in SBOM/Manifest sowie Registry-Pushes aufgenommen werden, das Scan-Gate auf das Non-Root-Image zielt und Release Notes oder die Image-README beide Varianten und ihre Einschränkungen beschreiben.

Vom Indexierungsmodell aus dem Issue-Text verfasst.