Update internal repo to support non-root user scenario

Related to: https://github.com/Azure/data-api-builder/issues/3514

## Background

Public PR Azure/data-api-builder#3520 restructured the sample `Dockerfile` into a multi-target build with two runtime variants:

- `runtime` (default / last stage) — runs as **root**, backwards-compatible with today's published image.
- `runtime-nonroot` (opt-in via `--target runtime-nonroot`) — runs as `USER $APP_UID` (UID 1654), satisfies scanners (e.g. Checkmarx One) that require a non-root `Config.User`.

The public `Dockerfile` is only a customer sample. The image we actually publish is built from the **internal repo**, which has its own `Dockerfile` + release pipeline YAML — both need updating to publish the second tag.

## Tasks

- [ ] Update the internal `Dockerfile` to match #3520 (multi-stage `runtime-base` → `runtime` / `runtime-nonroot`, `USER $APP_UID`, non-recursive `chown $APP_UID:$APP_UID /App/logs`).
- [ ] Update the pipeline to build + push **both** images: root (`:`, `:latest`) and non-root (`--target runtime-nonroot` → `:-nonroot`, `:latest-nonroot`).
- [ ] Run signing, SBOM/manifest, and registry push for both tags.
- [ ] Point the container scan gate at the `-nonroot` image.
- [ ] Update release notes / image README with the two variants and non-root consumer caveats.

まず、内部の Dockerfile とリリースパイプライン YAML を、公開 PR #3520 の変更と比較します。完了の条件は、root と non-root の両方のタグがビルドされ、署名され、SBOM/manifest とレジストリへのプッシュに含まれ、scan gate が non-root イメージを対象とし、release notes または image README に両方のバリアントとその注意点が記載されていることです。

索引モデルが issue の本文から書いたものです。