Build the image's static binary with netgo, osusergo and sqlite_omit_load_extension (closes #525)

The image's static relink linked glibc's getaddrinfo (from Go's cgo DNS
resolver) and dlopen (from SQLite extension loading). A static binary
still needs glibc's shared libraries at run time for both, and the
Alpine runtime has none. The relink now passes the standard build tags
netgo, osusergo and sqlite_omit_load_extension through a GO_TAGS
variable, which the Makefile's build target hands to go build as -tags
next to GO_LDFLAGS, so the version stamp is composed as before.

Model: opus-5-5

Makefile

@@ -16,14 +16,16 @@ VERSION ?= $(shell script/version)
 # exists to correct.
 override VERSION := $(or $(strip $(VERSION)),$(shell script/version))
 
-# Extra linker flags for the build target. The static relink in the
-# Dockerfile adds -extldflags here rather than passing its own -ldflags,
-# so composing flags cannot drop the version stamp.
+# Extra linker flags and build tags for the build target. The static
+# relink in the Dockerfile passes -extldflags and its build tags through
+# these rather than a -ldflags of its own, so composing flags cannot drop
+# the version stamp.
 #
 # The build target itself always passes -trimpath and -s -w, as the Go
 # Dockerfile in REPO_POLICIES.md does: no build paths, symbol table or
 # debug information in the binary.
 GO_LDFLAGS ?=
+GO_TAGS ?=
 
 bootstrap:
 	@script/bootstrap
@@ -53,7 +55,7 @@ check:
 	@script/check
 
 build: assets
-	go build -trimpath -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
+	go build -trimpath -tags '$(GO_TAGS)' -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker