Use COPY --link to share Go layer across OS variants / updates

This makes the Go layer reproducible such that re-pulling it can be avoided when switching between OS variants or OS updates.

```console
$ docker buildx build --builder foo --pull --build-arg BUILDKIT_SYNTAX=docker/dockerfile:1 1.21/alpine3.18 --quiet --output type=oci | tar -tv | grep a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
-r--r--r-- 0/0        67061931 1969-12-31 16:00 blobs/sha256/a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
$ docker buildx build --builder foo --pull --build-arg BUILDKIT_SYNTAX=docker/dockerfile:1 1.21/alpine3.19 --quiet --output type=oci | tar -tv | grep a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
-r--r--r-- 0/0        67061931 1969-12-31 16:00 blobs/sha256/a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
$ docker buildx build --builder foo --pull --build-arg BUILDKIT_SYNTAX=docker/dockerfile:1 1.21/bookworm --quiet --output type=oci | tar -tv | grep a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
-r--r--r-- 0/0        67061931 1969-12-31 16:00 blobs/sha256/a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
$ docker buildx build --builder foo --pull --build-arg BUILDKIT_SYNTAX=docker/dockerfile:1 1.21/bullseye --quiet --output type=oci | tar -tv | grep a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
-r--r--r-- 0/0        67061931 1969-12-31 16:00 blobs/sha256/a3881458cc9d5f6798ed03914b3fb322f3620ca53deca3b2c4460676912d16f5
```