PostgreSQL Percona pg_tde (TDE) image support

[souravbiswassanto]

Wires up a Percona / pg_tde image variant for postgres, mirroring how -ext
was added in #91. First tag is 17.9-percona.

Changes

• cmd/build-image/main.go — FindBlock gains a percona case, so a tag
  whose last - segment is percona resolves to library/<name>/tde.json
  (alongside the existing dhi.json / ext.json / app.json cases).
• library/postgres/tde.json — one block: 17.9-percona, built from
  tde/17.9/bookworm at appscode-images/postgres@f0fc44a.
• .github/workflows/build-postgres.yml — 17.9-percona added to the build
  matrix, next to the 17.9-*-ext tags.
• library/postgres/build_tags.txt — same tag added here too. This is the
  list cmd/generate-workflows renders $tags$ from and the one
  cmd/mail-report walks for the CVE report, so the workflow matrix entry only
  survives a workflow regeneration if the tag is here as well.

Result: ghcr.io/appscode-images/postgres:17.9-percona.

Why

KubeDB's Transparent Data Encryption support needs Percona's pg_tde, whose
tde_heap access method requires the Percona Server for PostgreSQL fork rather
than community PostgreSQL. So TDE needs its own image rather than an extension
layered on top of postgres:<major>-bookworm. The Dockerfile still keeps the
same runtime contract (uid/gid 999, binaries under /usr/lib/postgresql/17/bin,
upstream entrypoint + gosu, same PGDATA/locale/VOLUME/STOPSIGNAL/EXPOSE),
so the existing KubeDB run scripts work against it unchanged.

Architectures

tde.json lists only amd64 and arm64v8 — Percona publishes ppg-17 for
amd64, arm64 and i386 only, and the builder filters to amd64/arm64 anyway.
Both are present in repo.percona.com/ppg-17/apt (bookworm) and in the
ghcr.io/appscode-images/postgres:17.9-bookworm donor manifest.

Verified

• go build ./... and go vet ./cmd/build-image/ clean
• tag resolution exercised directly against the real library files:
  17.9-percona → tde.json (dir=tde/17.9/bookworm, commit=f0fc44a,
  2 architectures), while 17.9-bookworm-ext still resolves to ext.json and
  17.9-bookworm still resolves to app.json
• the Dockerfile builds for linux/amd64 and reports
  postgres (PostgreSQL) 17.9 - Percona Server for PostgreSQL 17.9.1, with
  pg_tde.control installed and pg_tde_basebackup / pg_tde_rewind /
  pg_tde_waldump / pg_tde_resetwal all executable

Note on naming

The tag is 17.9-percona (no distro segment) while the Dockerfile lives at
tde/17.9/bookworm — the directory keeps the <variant>/<version>/<distro>
layout the ext/dhi trees use, and the manifest file stays tde.json since it
is keyed by capability rather than vendor. Say the word if you'd rather the
directory or file follow the tag name instead.

Pre-existing gap, not fixed here

The six -ext tags and the -dhi tags were never added to
library/postgres/build_tags.txt, so running cmd/generate-workflows today
would drop them from the matrix (and also revert runs-on: firecracker and the
pinned action SHAs). Happy to add them in this PR if you want that cleaned up at
the same time.

Postgres repo PR: appscode-images/postgres#1 (branch tde is already pushed, so
the commit f0fc44a referenced above is fetchable now).