Update internal repo to support non-root user scenario

Related to: https://github.com/Azure/data-api-builder/issues/3514

## Background

Public PR Azure/data-api-builder#3520 restructured the sample `Dockerfile` into a multi-target build with two runtime variants:

- `runtime` (default / last stage) — runs as **root**, backwards-compatible with today's published image.
- `runtime-nonroot` (opt-in via `--target runtime-nonroot`) — runs as `USER $APP_UID` (UID 1654), satisfies scanners (e.g. Checkmarx One) that require a non-root `Config.User`.

The public `Dockerfile` is only a customer sample. The image we actually publish is built from the **internal repo**, which has its own `Dockerfile` + release pipeline YAML — both need updating to publish the second tag.

## Tasks

- [ ] Update the internal `Dockerfile` to match #3520 (multi-stage `runtime-base` → `runtime` / `runtime-nonroot`, `USER $APP_UID`, non-recursive `chown $APP_UID:$APP_UID /App/logs`).
- [ ] Update the pipeline to build + push **both** images: root (`:`, `:latest`) and non-root (`--target runtime-nonroot` → `:-nonroot`, `:latest-nonroot`).
- [ ] Run signing, SBOM/manifest, and registry push for both tags.
- [ ] Point the container scan gate at the `-nonroot` image.
- [ ] Update release notes / image README with the two variants and non-root consumer caveats.

Inizia confrontando il Dockerfile interno e lo YAML della pipeline di release con le modifiche del PR pubblico #3520. Il lavoro è completato quando vengono compilati, firmati e inclusi nella SBOM/manifest e nei registry push sia i tag root che quelli non-root, lo scan gate punta all’immagine non-root e le release notes o l’image README descrivono entrambe le varianti e le relative limitazioni.

Scritto dal modello di indicizzazione a partire dal testo della issue.