perf: keep build caches out of the image (uv/go/cargo/apt)

[ai-anant]

Summary

The aidc image was shipping build-time caches that serve no runtime purpose, inflating every project image by roughly 0.5–1.5 GB depending on toolchains:

• uv download cache (/root/.cache/uv) — semgrep + ast-grep wheels (~100s MB)
• Go build + module cache after compiling gosec (~/.cache/go-build, ~/go)
• Cargo registry + git + target after compiling cargo-audit --locked from source (~1 GB)
• apt archives and stale gem cache from bundler-audit

Changes (templates/devcontainer/Dockerfile.tmpl)

• uv steps use BuildKit cache mounts (RUN --mount=type=cache,target=/root/.cache/uv) — downloaded wheels live in the builder cache (fast rebuilds) but never land in the image.
• Go toolchain: GOPATH=/tmp/gopath GOCACHE=/tmp/go-build for the gosec compile, then rm -rf — keeps the module cache out of ~/.cache / ~/go.
• Rust toolchain: CARGO_TARGET_DIR=/tmp/cargo-target for the cargo-audit compile, then removes /tmp/cargo-target, ~/.cargo/registry, ~/.cargo/git. The installed cargo-audit binary (symlinked into ~/.local/bin) survives.
• apt: added apt-get clean + remove /var/cache/apt/archives/*.deb in the base layer; the toolchain loop already cleans apt lists.
• Ruby: drops the gem cache after bundler-audit.
• uv security tools (checkov, bandit): uv cache clean after install (no cache mount there since they run as vscode).

Requires BuildKit (Docker 23+ default; compose v2 uses it automatically). docker build --check passes.

Expected impact

• ~0.5–1.5 GB smaller images (biggest win on Rust projects).
• Rebuilds stay fast (uv wheels cached in BuildKit, not re-downloaded).
• No behavior change: all installed binaries (semgrep, gosec, cargo-audit, bandit, checkov) remain on PATH.

Test plan

• docker build --check on the template (BuildKit parse, no warnings)
• Toolchain loop bash fragment syntax-checked
• bash -n, shellcheck -x, bash-3.2 compat check — clean
• tests/resolve-oauth-token.test.sh — 7/7 pass

Closes #10