fix(docker): support non-root base image

[sagic-orca]

Summary

• The ghcr.io/orcasecurity/orca-cli:1 base image now sets USER orca (non-root) at the end of its build.
• Any RUN apk add executed after the FROM line was failing with permission denied because the inherited user had no write access to the package cache.
• Add USER root immediately after the FROM line so package installation and build steps run with the necessary privileges.
• Drop back to USER orca just before the ENTRYPOINT to preserve runtime least-privilege security.

Test plan

• Build the Docker image locally and confirm apk add completes without permission errors.
• Verify the container process runs as orca (non-root) at runtime: docker run --rm <image> whoami → orca.
• Confirm the action end-to-end behaviour is unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca