Update Debian version to trixie

[maraino]

This commit updates the Debian version in the docker images from bookworm to trixie, the latest stable version.

Requires:

• Update Debian docker image to use trixie cli#1530
• Update Debian version to trixie step-kms-plugin#287

Fixes #2469, #2480

@hslatman @tashian: I wasn't sure how to avoid using the shell, without it the environment variables are not expanded. And if I use the old version, that will use a shell, the docker language server complains with:

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals (JSON arguments recommended for CMD to prevent unintended behavior related to OS signals)Docker DX (docker-language-server) JSONArgsRecommended

I've decided to hardcode the password and configuration path, so you can have step-ca running with the PID 1 with a command like this:

docker run --rm \
  -e DOCKER_STEPCA_INIT_NAME=localhsot \
  -e DOCKER_STEPCA_INIT_DNS_NAMES=localhost \
  smallstep/step-ca:hsm

And k8s or docker allows you to change the CMD easily.

[hslatman]

@maraino also see #2480 and #2469.

[hslatman]

Changing it to not use the environment variables could break existing deployments, although I doubt many would've changed the location of the password file. If we're OK with that, then I think the ENV declarations can be removed too?

[hslatman]

It worked because of the exec, I suppose, as then it would run a shell? If you change the CMD to use e.g. ["sh", "-c", "step-ca ..."] they would get interpreted too, I believe, but then the CA runs as a subprocess.

One workaround could be to have step-ca read the password file flag value from the environment directly instead of from the flag? Basically what we do in other places supporting both environment variables and flags.