docker: bind-mount the wheels instead of COPY + rm

COPY --from=builder /wheels /wheels commits the wheels as their own
layer; the rm -r /wheels in the next RUN writes a whiteout and does not
un-commit them, so they ship in every pull.

Measured on the published image pythonopenapi/openapi-spec-validator:0.8.2: layer ef2bee5a338d is
1,698,738 of 25,227,374 compressed bytes on amd64 (6.73%), and
1,674,155 of 25,602,635 on arm64.

Bind-mounting the builder stage's /wheels for the one RUN that needs it
installs the same wheels without committing them, and makes the rm
unnecessary. Requires BuildKit, which docker-publish.yml already uses.

Author: sujeito-operator

Dockerfile

@@ -13,9 +13,8 @@ FROM python:3.14.5-alpine
 
 ARG OPENAPI_SPEC_VALIDATOR_VERSION
 
-COPY --from=builder /wheels /wheels
 RUN apk add --no-cache libgcc
-RUN pip install --no-cache-dir --pre --find-links /wheels openapi-spec-validator==${OPENAPI_SPEC_VALIDATOR_VERSION} && \
-    rm -r /wheels
+RUN --mount=type=bind,from=builder,source=/wheels,target=/wheels \
+    pip install --no-cache-dir --pre --find-links /wheels openapi-spec-validator==${OPENAPI_SPEC_VALIDATOR_VERSION}
 
 ENTRYPOINT ["openapi-spec-validator"]