Build our own caddy image (#61881)

* Add initial caddy image config

* Add initial scaffold for new image

* Add caddy image tests

* Update caddy lockfile

* Invalidate repo when *any* file changes, not just existing ones

The old setup resulted in a circular dep where if you added a new image, then to trigger an update you had to edit an existing lockfile.

Ideally we'd only invalidate when a wolfi-images/*.lock.json file changes, but unsure if this is possible

* Remove comment

* Use watch_tree for repo invalidation

docker-images/caddy/BUILD.bazel

@@ -0,0 +1,42 @@
+load("//dev:oci_defs.bzl", "image_repository", "oci_image", "oci_push", "oci_tarball")
+load("@container_structure_test//:defs.bzl", "container_structure_test")
+load("//wolfi-images:defs.bzl", "wolfi_base")
+
+oci_image(
+    name = "image",
+    base = ":base_image",
+    entrypoint = [
+        "caddy",
+        "run",
+        "--config",
+        "/etc/caddy/Caddyfile",
+        "--adapter",
+        "caddyfile",
+    ],
+)
+
+oci_tarball(
+    name = "image_tarball",
+    image = ":image",
+    repo_tags = ["caddy:candidate"],
+)
+
+container_structure_test(
+    name = "image_test",
+    timeout = "short",
+    configs = ["image_test.yaml"],
+    driver = "docker",
+    image = ":image",
+    tags = [
+        "exclusive",
+        "requires-network",
+    ],
+)
+
+oci_push(
+    name = "candidate_push",
+    image = ":image",
+    repository = image_repository("caddy"),
+)
+
+wolfi_base()

docker-images/caddy/image_test.yaml

@@ -0,0 +1,14 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+  - name: "caddy is runnable"
+    command: "caddy"
+    args:
+      - version
+
+fileExistenceTests:
+- name: '/etc/caddy/Caddyfile'
+  path: '/etc/caddy/Caddyfile'
+  shouldExist: true
+  uid: 0
+  gid: 0