Better handle VCS checkouts and clones in a Docker image

Somehow we do not ignore .git directories in the docker pipeline
That both good and bad:
1. there is some (small) value to know we have a git checkout and that could be important origin clues
2. these are generally ignored by scancode-toolkit with https://github.com/nexB/commoncode/blob/main/src/commoncode/ignore.py

In the current way, this ends up being noise.