Implement `openscap` tool in `bakery` for image hardening

Rather than pursuing hardened images by using a hardened base image (e.g. wolfi or distroless), we can opt to harden our images based on CIS Benchmarks for server hardening. The OpenSCAP tool is provided as an image by Chainguard and can allow us to test our images against policies provided by the Security Team and remediate violations.

@aja08379 has created a Github Action to scan an image in a repository against the desired policy standard. Reviewing the Github Action will be immensely helpful for understanding how best to implement OpenSCAP and could possibly be used long-term in Workbench for Snowflake as long as they maintain their own image.

OpenSCAP seems like another tool we could easily implement as another extension to bakery like dgoss and snyk. Ideally, we will want a way to consume standard runtime options and policy standards upstream from the Security team rather than updating individual repositories over time.

Currently, only Ubuntu 22.04 is supported for benchmarking so any hardened images we provide must be based on that version. The Security Team suggests only maintaining one version of the hardened image, but I could foresee "hardened" becoming another image type in the future alongside "min" and "std". To our knowledge, the only product with hardened demand is Workbench.

Start by reading the existing bakery extensions for dgoss and snyk, then review the GitHub Action created by @aja08379 and the OpenSCAP image documentation. Define how runtime options and Security Team policies enter the extension, and confirm that the resulting hardened image can be benchmarked on Ubuntu 22.04.