Runtime container image contains development packages that may not be required for production deployment

### Bug description

## Issue

While performing SBOM/security analysis of the Apache Superset container image, we identified several development packages present in the runtime image.

Observed packages:
- devlop
- libc-dev-bin
- libc6-dev
- libcrypt-dev
- libexpat1-dev
- libpython3.11-dev
- linux-libc-dev
- preact-devtools
- python3.11-dev
- zlib1g-dev

Many of these packages are development-oriented packages that typically provide header files, static libraries, compiler support files, or debugging/developer tooling used during software compilation rather than during runtime execution.

## Why this matters

From a security and compliance perspective, development packages in production container images are often flagged because they:

- Increase image size
- Increase the attack surface
- Increase the number of components tracked in SBOMs
- Potentially increase the CVE footprint
- Make it more difficult to distinguish runtime dependencies from build-time dependencies

## Packages identified

### Linux development packages

- libc-dev-bin
- libc6-dev
- libcrypt-dev
- libexpat1-dev
- libpython3.11-dev
- linux-libc-dev
- python3.11-dev
- zlib1g-dev

These packages appear to provide development headers and build-time artifacts used for compiling native libraries or Python extensions.

### Frontend development tooling

- preact-devtools

This package appears to be related to frontend development/debugging rather than production runtime functionality.

### Additional package

- devlop

This package was also identified during the SBOM scan. It is unclear whether it is intended to be present in the final runtime image or whether it is a build-time dependency.

## Request

Could the maintainers review whether these packages are required in the production Superset container image?

Specifically:

- Are these packages intentionally included for runtime functionality?
- Are they pulled in as part of the image build process but not actually required at runtime?
- Could any of these development packages be excluded from the final image through multi-stage builds or dependency cleanup?

If some of these packages are intentionally retained due to packaging requirements, clarification would be helpful for security and compliance reviews.

Thank you for your time and for maintaining Apache Superset.

### Screenshots/recordings

_No response_

### Superset version

6.1.0

### Python version

Not applicable

### Node version

Not applicable

### Browser

Not applicable

### Additional context

_No response_

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Start by reproducing the SBOM/security analysis against the Superset 6.1.0 runtime container image and tracing how the listed packages enter the final image. Determine which packages are required at runtime, remove those that are not, and document any packages intentionally retained for packaging requirements.

Written by the indexing model from the issue text.