ROX-24700: Resolve CentOS 8 deprecation

[BradLugo]

Description

Dockerfiles/Containerfiles using quay.io/centos/centos:stream8 as the base image were breaking due to the removal of mirrorlist.centos.org.
Example: https://github.com/stackrox/rox-ci-image/actions/runs/10011868762/job/27676182918

These changes substitute ubi8:latest in place of centos:stream8 and add another image, stackrox-ui-test, to enable X11 support, which is required for running UI tests (particularly in OSCI).

Testing

Changes have been validated here:

• chore(build): try ubi8 for build/test images stackrox#11491
• stackrox: update stackrox-test image to use ubi8 openshift/release#54854
• chore(ci): use UBI 8 based rox-ci-image scanner#1589
• chore(ci): add Scanner V4 DB integration tests stackrox#11489

Other approaches

CentOS Vault mirror

This is a valid option and probably the most reasonable way to get this working. If I had known about it when I first started this work, I would probably have done this just to get everything working again. But the longer-term fix is already in this PR.

Use UBI8 in the UI tests

Red Hat folks have explicitly stated that X11 packages will not be supported in UBI registries.

CentOS Stream 9 across the board

This is problematic due to CGO and glibc versions mismatching in CI. See the following PRs for more details:

• try centos stream9 #206
• Update centos to stream9 #209
• chore: switch builder to centos stream9 stackrox#12028
• stackrox: stream9 rox-ci openshift/release#54432

Future improvements

For a cleaner solution in the future, I propose we:

• Consolidate stackrox-build and stackrox-test into a single image that contains all tools that are required for development and running everything expected to work in GitHub Actions and Konflux
• Figure out all the necessary dependencies and packages for the above ^ remove everything not required
• Continue to use stackrox-ui-test, possibly remain to something more meaningful (maybe stackrox-osci or stackrox-e2e-test?), and also remove all unnecessary dependencies and packages after investigating them

[BradLugo]

A side note: it's not clear to me why we have stackrox-build and stackrox-test. I suspect there's a historical reason (here's the PR stackrox-test was introduced: #112) to be more consistent with other OCP teams. But we use GitHub Actions in https://github.com/stackrox/stackrox to build our container images now, so I don't currently see a reason to keep both of them around.

[BradLugo]

Most of the testing has been done here:

• chore(build): try ubi8 for build/test images stackrox#11491
• stackrox: update stackrox-test image to use ubi8 openshift/release#54854

[RTann]

nit: newline

[davdhacs]

looks great
One question but not blocking merge.

[RTann]

I created stackrox/scanner#1589 to confirm Scanner v2 can still build with this image, if you want to see

[RTann]

Scanner images LGTM, thanks