Require Docker 23, Statically link Krane

[cbgbt]

Issue number:

Closes #417

Description of changes:

---

krane: statically link krane into twoliter

This change implements a small FFI library in golang which emulates the
`krane` program from google/go-containerregistry.

Prior to this change, we'd experimented with two approaches to using
`krane` within twoliter, but both approaches had unfortunate
complications:

* Writing `krane` to a sealed anonymous file and executing it -- this
  approach would cause twoliter to be killed by some threat detection
  software. Executing sealed anonymous files is commonly restricted on
  Linux systems
* Writing `krane` to a tempfile and executing it -- it's difficult to
  get Rust to reliably delete named tempfiles, which led to twoliter
  leaking tempfiles of the `krane` binary.

---

twoliter: require Docker 23

Docker versions older than 23 no longer receive community-supported
security patches.

Additionally, twoliter requires dockerfile syntax 1.4.3. Currently the
tool pulls this image from the network at build time; however, Docker 23
bundles this version internally via buildkit. We can further isolate
twoliter builds from the network by ensuring we are on Docker 23 or
greater.

---

twoliter: refactor project to reduce module length

The project module is large, making it difficult to organize and read.
This moves much of the vended image/artifact machinery into a new
module. We also add a new trait to help us write functionality over
both Projects that are fully locked and Projects with a locked SDK.

---

twoliter: fetch build SDK prior to cargo-make

Now that `krane` is run as a static library, we cannot execute it within
Makefile.toml.

This change moves the SDK fetch to occur prior to executing build make
targets.

---

Testing done:

• Integration tests
• Manual testing of signal handler (ctrl-c while downloading SDK)
• Manual testing of kit publication
• Test with AWS Codebuild (used by bottlerocket team for release CI)

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[cbgbt]

^ addresses feedback from @yeazelm, as well as experimenting with fixes for build failures on other hosts.

Basically, I had originally generated go.{mod,sum} using go-1.23. After downgrading the required version of go to 1.22, I needed to delete my indirect dependencies and re-run go mod tidy.

[cbgbt]

I made registration of the cleanup signal only fail with a warning. The signal registration fails in AWS CodeBuild for a reason that isn't quite clear to me.

But cleanup on signals is already best-effort, I think proceeding without it is acceptable.

[jpculp]

Interesting that it dropped.