Make model-engine FIPS compliant by updating base chainguard image

[ValentineDragan]

Pull Request Summary

This PR upgrades the model-engine Docker base image to use Chainguard's FIPS-compliant Python image, and fixes bugs in the CircleCI integration tests.

FIPS compliance changes:

• Update Dockerfile to use chainguard base image for FIPS compliance
  • Delete the now identical federal/Dockerfile copy
• Upgrading SQLAlchemy to 2.0.21 which uses FIPS-compliant md5 hashing
  • This removes the need to monkey patching the hashing library with sitecustomize.py which was making integration tests fail because md5 is still needed for non-security hashing (i.e. generating Git/CircleCI hashes)
• Set celery_enable_sha256: true in all configs for FIPS compliance

Fixing integration tests:

• Update integration tests to use the current/latest model-engine image instead of a hardcoded image tag from 2024
• Update helm chart to mount service configs in CircleCI
• Add chainctl authentication to CircleCI to enable pulling the chainguard base image

Test Plan and Usage Guide

• All unit tests and integration tests pass
  • (previously integration tests weren't reflecting the latest repo changes due to using hardcoded image)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	sqlalchemy@​2.0.4 ⏵ 2.0.21

View full report

[dmchoiboi]

curious if you needed to add this for specific reason? do you actually use batch-job-orchestration-job