Docker containers aren't reproducible

[r-n-o]

Flagged by @james-callahan in #11: #11 (comment)

We could address this with:

• COPY into a /newroot
• fix timestamps in /newroot
• Do a FROM scratch + COPY --from to flatten the COPYs away

Or use toolchain (https://git.distrust.co/public/toolchain)

[james-callahan]

Example over at https://github.com/tkhq/ecr-proxy/blob/d11338eba841287a1e8326560c5679e2a07d34d3/Dockerfile#L26-L35