What this PR does / why we need it:

The go-feature-server image is built and published straight from the full golang:1.26 image. Every tag therefore ships the Go toolchain, gcc, protoc, the module and build caches, and Debian development packages such as linux-libc-dev. Scanners flag that package for DSA-6238-1, DSA-6253-1, DSA-6274-1 and DSA-6295-1. Users can't remediate it because it comes from the base layer.

This PR turns the Dockerfile into a two-stage build:

• Builder stage: the existing steps (protoc install, proto generation, go build), unchanged. The base is pinned to golang:1.26-trixie, which is what golang:1.26 resolves to today.
• Runtime stage: debian:trixie-slim with ca-certificates, plus the compiled feast binary. The binary is cgo-linked (go-sqlite3), so the runtime uses the same Debian release as the builder to get a matching glibc.

These stay the same: the working directory /app, the binary path ./feast, the exposed port and the default command. Existing deployments that mount the feature repo under /app or pass --chdir keep working.

Result (linux/arm64 build):

ldd ./feast in the runtime image shows only libc.so.6 and the dynamic loader.

Which issue(s) this PR fixes:

Fixes #7060

Checks

• I've made sure the tests are passing.
• My commits are signed off (git commit -s)
• My PR title follows conventional commits format

Testing Strategy

• Unit tests
• Integration tests
• Manual tests
• Testing is not required for this change

Manual tests:

• Built the image with docker buildx build -f go/infra/docker/feature-server/Dockerfile --load ..
• Inside the image, checked ldd ./feast, dpkg -s linux-libc-dev (not installed), and that /usr/local/go, gcc and protoc are absent.
• Ran ./feast --type=http --chdir=<mounted repo> against a repo with a local registry and a SQLite online store:
  • the HTTP and metrics servers start
  • /health returns Healthy
  • /get-online-features reaches the registry lookup and returns the expected "feature view doesn't exist" error for the empty registry

Misc

No Go code changes. make build-go-feature-server-docker and the publish workflow use the same Dockerfile path and arguments, so nothing changes in CI.