[minor] Add allowInsecureArgs to scyllaridae.yml

[joecorall]

This PR does two things:

1. Restructures the scyllaridae Dockerfile to build the go binary in a multi-stage build. This is to allow testing PRs on https://github.com/Islandora/scyllaridae easier (e.g. [minor] Add allowInsecureArgs to yaml spec Islandora/scyllaridae#164)
2. Adds allowInsecureArgs as an environment variable microservices can set to allow dangerous bash characters in X-Islandora-Args HTTP headers.

How to test

Update your houdini service to use this PR's houdini image

services:
  houdini:
    image: islandora/houdini:insecure-args

Restart your service

docker compose up -d

Request a PNG from the service

docker compose exec -it houdini curl -sf \
  -H "Apix-Ldp-Resource: https://preserve.lehigh.edu/themes/custom/lehigh/assets/img/favicon76.png" \
  -H "X-Islandora-Args: -resize 10000x10000>" \
  -H "Accept: image/png" http://localhost:8080/ > image.png || echo "file not created"

file not created should print since there is an insecure bash argument in X-Islandora-Args (i.e. >)

Update your houdini service to allow insecure args

services:
  houdini:
    image: islandora/houdini:insecure-args
     environment:
      SCYLLARIDAE_ALLOW_INSECURE_ARGS: "true"

Restart your service

docker compose up -d

Request a PNG from the service

docker compose exec -it houdini curl -sf \
  -H "Apix-Ldp-Resource: https://preserve.lehigh.edu/themes/custom/lehigh/assets/img/favicon76.png" \
  -H "X-Islandora-Args: -resize 10000x10000>" \
  -H "Accept: image/png" http://localhost:8080/ > image.png && echo "file created"

file created should print even though there is an insecure bash argument in X-Islandora-Args (i.e. >).

There should be a file on your system that's a 76x76 PNG

$ file image.png
image.png: PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced

[nigelgbanks]

Looks good to me.

[t4k]

I haven't had a chance to test this myself, but what I can see here looks good. Unfortunately, I won't be able to make the Tech Call today.

[t4k]

I've now tested this and it works great for my use case! ✅