fix: provide separate nonroot image (#3998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>

Dockerfile

@@ -1,12 +1,14 @@
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian12:latest AS build
+
+FROM scratch
+# needed for version check HTTPS request
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp
 
 COPY syft /
 
-USER nonroot
-
 ARG BUILD_DATE
 ARG BUILD_VERSION
 ARG VCS_REF