[enh] Add opa_image Dockerfile build argument

[tibotix]

This is an improvement on top of #316 .

This PR changes the opa_tag Docker build argument to the opa_image Docker build argument.

The opa_image build argument allows for arbitrary docker images to be included in the opal standalone client as opposed to only an arbitrary tag. This makes it easier to integrate custom builds of opa within the opal-client by allowing to specify a different docker image repository other than the official openpolicyagent/opa repository. Custom opa builds may be needed for custom opa plugin integration.

[netlify]

✅ Deploy Preview for opal-docs canceled.

Name	Link
🔨 Latest commit	e780a27
🔍 Latest deploy log	https://app.netlify.com/sites/opal-docs/deploys/637269e91601150008d4223e

[orishavit]

Hi @tibotix - thanks for the PR! I fear that this might be a bit of security risk - @asafc wdyt?

[tibotix]

This is as secure as the input to the build argument opa_image is.
I understand your concerns, but do not think that this poses a high security risk, given the assumption that the input to the opa_image build argument is correctly parsed.

One thing we could do here though, is to split opa_image into 2 separate build arguments opa_image and opa_tag.
opa_image would contain the default string openpolicyagent/opa.
opa_tag would contain the default string latest-static.
The docker image reference would then be constructed using docker://${opa_image}:${opa_tag}.
In this way one who only want to change the official opa tag, could only use the opa_tag build argument and is safe again, as the opa_image build argument does not need to be specified and defaults to openpolicyagent/opa.

[tibotix]

@orishavit I've added the opa_tag argument again to ensure a more fine grained control over the opa docker image source repository. Any updates on wether this can be merged? Please let me know :)