provenance/Dockerfile: Evolve to compile the rust provenance crate

```
root@d79ab1e18df7:/opt/swh# swh-provenance-
swh-provenance-gen-test-database  swh-provenance-grpc-serve         swh-provenance-index
root@d79ab1e18df7:/opt/swh# swh-provenance-index --help
Builds .ef indexes for extra quick querying of the Software Heritage Provenance Index

Usage: swh-provenance-index [OPTIONS] --database <DATABASE>

Options:
      --database <DATABASE>        Path to the provenance database
      --indexes <INDEXES>          Path to the directory where to write paths to. Defaults to `--database` (when it is a file:// URL)
      --statsd-host <STATSD_HOST>  Defaults to `localhost:8125` (or whatever is configured by the `STATSD_HOST` and `STATSD_PORT` environment variables)
  -h, --help                       Print help
root@d79ab1e18df7:/opt/swh# swh-provenance-grpc-serve --help
gRPC server for the Software Heritage Provenance Index

Usage: swh-provenance-grpc-serve [OPTIONS] --graph <GRAPH> --database <DATABASE>

Options:
      --cache-parquet                Keep Parquet metadata in RAM between queries, instead of re-parsing them every time
      --graph-format <GRAPH_FORMAT>  [default: webgraph] [possible values: webgraph, json]
      --graph <GRAPH>                Path to the graph prefix
      --database <DATABASE>          Path to the provenance database
      --indexes <INDEXES>            Path to Elias-Fano indexes, default to `--database` (when it is a file:// URL)
      --bind <BIND>                  [default: [::]:50141]
      --statsd-host <STATSD_HOST>    Defaults to `localhost:8125` (or whatever is configured by the `STATSD_HOST` and `STATSD_PORT` environment variables)
  -h, --help                         Print help
```

Refs. sysadm-environment#5608

apps/swh-provenance/Dockerfile

@@ -2,17 +2,42 @@ ARG REGISTRY=container-registry.softwareheritage.org/swh/infra/swh-apps/
 ARG base_image=${REGISTRY}base
 ARG base_image_version=latest
 
-FROM ${base_image}:${base_image_version}
-
+ARG userid=1000
+ARG groupid=1000
 ARG user=swh
 ARG workdir=/opt/${user}
 ARG configdir=/etc/${user}
 
+FROM rust:1.85-bookworm AS rust_build
+
+# ... build swh-graph rust deps
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get install -y build-essential libclang-dev \
+      zstd protobuf-compiler default-jre && \
+    apt-get clean
+
+# Install swh-graph feature swh-graph-grpc-serve
+RUN --mount=type=cache,target=.cache,uid=1000,gid=1000 \
+  RUSTFLAGS="-C target-cpu=native" \
+  cargo install swh-provenance --locked
+
+FROM ${base_image}:${base_image_version}
+
+USER root
+RUN apt-get update && \
+    apt-get install -y zstd && \
+    apt-get clean
+
+FROM ${base_image}:${base_image_version}
+
 COPY --chmod=0644 requirements-frozen.txt ${workdir}
 RUN --mount=type=cache,target=.cache,uid=1000,gid=1000 \
     uv pip sync requirements-frozen.txt
 
 COPY --chmod=0755 entrypoint.sh ${workdir}
+COPY --from=rust_build /usr/local/cargo/bin/swh-provenance* /usr/local/bin/
+COPY --chmod=0755 entrypoint.sh ${workdir}
 
 USER ${user}
 ENV SWH_CONFIG_FILENAME=${configdir}/config.yml