goreleaser: use netgo and osusergo to ensure completely static binary builds

[joelanford]

Description of the change:
Use netgo and osusergo when building binaries for opm image to ensure completely static binary builds.

Motivation for the change:
The current goreleaser build results in an image with a binary that panics when the network is used (e.g. opm render with a remote image)

Reviewer Checklist

• Implementation matches the proposed design, or proposal is updated to match implementation
• Sufficient unit test coverage
• Sufficient end-to-end test coverage
• Docs updated or added to /docs
• Commit messages sensible and descriptive

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelanford

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [joelanford]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Merging #821 (e73407a) into master (7c8187a) will increase coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #821      +/-   ##
==========================================
+ Coverage   50.93%   50.94%   +0.01%     
==========================================
  Files         103      103              
  Lines        9001     9001              
==========================================
+ Hits         4585     4586       +1     
+ Misses       3552     3551       -1     
  Partials      864      864              

Impacted Files	Coverage Δ
pkg/registry/query.go	60.93% <0.00%> (+0.52%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7c8187a...e73407a. Read the comment docs.

[timflannagan]

I think if I squint I can see why osusergo is needed but it's not immediately obvious outside of opm's general domain what command is triggering the need for that tag.

/lgtm

[joelanford]

🙏

I'm not positive if osusergo is actually necessary, but since we don't have anything that actually tests the results of our binary builds, I figured it was best to err on the side of caution.