Support reproducible builds (except packages)

See docker-library/official-images issue 16044

- `ARG SOURCE_DATE_EPOCH` is added.
  The argument value is consumed by the build scripts to make the binary reproducible.

- For Debian, `/var/log/*` is removed as they contain timestamps

- For Debian, `/var/cache/ldconfig/aux-cache` is removed as they contain inode numbers, etc.

- For Alpine, virtual package versions are pinned to "0" to eliminate
  the timestamp-based version numbers that appear in `/etc/apk/world` and `/lib/apk/db/installed`

> [!NOTE]
> The following topics are NOT covered by this commit:
>
> - To reproduce file timestamps in layers, BuildKit has to be executed with
>   `--output type=<TYPE>,rewrite-timestamp=true`.
>   Needs BuildKit v0.13 or later.
>
> - To reproduce the base image by the hash, reproducers may:
>   - modify the `FROM` instruction in Dockerfile manually
>   - or, use the `CONVERT` action of source policies to replace the base image.
>     <https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md>
>
> - To reproduce packages, see the `RUN` instruction hook proposed in
>   moby/buildkit issue 4576

Also, Alpine-based images still have the following diff:
```diff
diff -ur /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed
--- /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
+++ /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
@@ -1,4 +1,4 @@
-C:Q1z4Lv7mwS00FpNJwDUHdH70eM2ic=
+C:Q1gHSJHNX/rtq0yNsVTKaNb96s8Mk=
 P:.ruby-rundeps
 V:0
 A:noarch
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Author: AkihiroSuda

3.0/alpine3.16/Dockerfile

@@ -13,6 +13,9 @@ FROM debian:{{ env.variant | ltrimstr("slim-") }}-slim
 FROM buildpack-deps:{{ env.variant }}
 {{ ) end -}}
 
+# SOURCE_DATE_EPOCH is consumed by build scripts
+ARG SOURCE_DATE_EPOCH
+
 {{ if is_alpine then ( -}}
 RUN set -eux; \
 	apk add --no-cache \
@@ -38,7 +41,9 @@ RUN set -eux; \
 		procps \
 		zlib1g-dev \
 	; \
-	rm -rf /var/lib/apt/lists/*
+	rm -rf /var/lib/apt/lists/*; \
+# clean up for reproducibility
+	rm -rf /var/log/* /var/cache/ldconfig/aux-cache
 
 {{ ) else "" end -}}
 # skip installing gem documentation
@@ -67,7 +72,7 @@ ENV RUBY_DOWNLOAD_SHA256 {{ .sha256.xz }}
 RUN set -eux; \
 	\
 {{ if is_alpine then ( -}}
-	apk add --no-cache --virtual .ruby-builddeps \
+	apk add --no-cache --virtual .ruby-builddeps=0 \
 		autoconf \
 {{ if [ "3.0", "3.1", "3.2" ] | index(env.version | rtrimstr("-rc")) then ( -}}
 {{ # https://github.com/docker-library/ruby/pull/438 -}}
@@ -132,6 +137,8 @@ RUN set -eux; \
 {{ ) else "" end -}}
 	; \
 	rm -rf /var/lib/apt/lists/*; \
+# clean up for reproducibility
+	rm -rf /var/log/* /var/cache/ldconfig/aux-cache ;\
 {{ ) end -}}
 {{ if .rust.version then ( -}}
 	\
@@ -275,7 +282,7 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-network --virtual .ruby-rundeps $runDeps; \
+	apk add --no-network --virtual .ruby-rundeps=0 $runDeps; \
 	apk del --no-network .ruby-builddeps; \
 {{ ) else ( -}}
 	apt-mark auto '.*' > /dev/null; \
@@ -289,6 +296,8 @@ RUN set -eux; \
 		| xargs -r apt-mark manual \
 	; \
 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+# clean up for reproducibility
+	rm -rf /var/log/* /var/cache/ldconfig/aux-cache ;\
 {{ ) end -}}
 	\
 	cd /; \