[feature](k8s) enable ddc debug - #59292

…7561)

Cherry-pick all docker/runtime/ changes from apache/doris master that
are missing in branch-hotfix-selectdb-doris-3.1-hubspot.

Includes changes from PRs:
apache#42068 apache#42208 apache#42564 apache#42605 apache#43040 apache#43085 apache#43200 apache#45503 apache#45926 apache#46387
apache#47342 apache#47837 apache#48183 apache#48839 apache#48898 apache#49343 apache#49874 apache#50247 apache#50536 apache#50604
apache#50745 apache#50922 apache#51357 apache#51693 apache#54321 apache#54392 apache#54950 apache#55299 apache#55548 apache#55615
apache#55671 apache#55824 apache#56471 apache#56757 apache#56917 apache#57113 apache#57236 apache#57345 apache#57374 apache#57695
apache#58229 apache#58565 apache#58638 apache#59039 apache#59292 apache#59480 apache#59553 apache#60060 apache#60458

## Proposed changes

Issue Number: close #xxx

<!--Describe your changes.-->

Co-authored-by: catpineapple <[email protected]>

…ase image

### What problem does this PR solve?

Issue Number: none

Related PR: none

Problem Summary:

`trivy image apache/doris:fe-4.1.4` reports 59 CRITICAL findings, and 54 of them
are Linux kernel CVEs attributed to two packages that the runtime image has no
reason to carry:

```
linux-libc-dev     5.15.0-164.174  27 CRITICAL (6 with no fixed version)
linux-tools-common 5.15.0-164.174  27 CRITICAL (6 with no fixed version)
```

The same 54 appear in be-4.1.4 (62 total) and ms-4.1.4 (57 total).

Root cause in code: three entries of the base image's apt list pull them in
transitively. Verified by `apt-get install -s` on ubuntu:22.04:

- `linux-tools-realtime` -> `linux-tools-common`
- `libperl-dev`          -> `linux-libc-dev` + `libc6-dev`
- `python2-dev`          -> `linux-libc-dev` + `libc6-dev`

These packages are built from the `linux` and `glibc` source packages, so Ubuntu
maps every kernel CVE onto them, but they ship only UAPI headers and perf wrapper
scripts. The vulnerable code runs in the host kernel, which a container image
cannot patch or worsen, so the findings are not actionable inside the image. Six
of them have no fixed version at all, so an `apt upgrade` can never clear the
count - only removing the packages does.

What the removed packages provided:

- `linux-tools-realtime` existed solely for the `/usr/bin/perf` symlink, and
  `bpfcc-tools` + `linux-headers-realtime` for BCC. Both are host-kernel-coupled:
  they need `--privileged` and a kernel matching the headers baked into the image
  to work at all, so a debug sidecar sharing the target pod's namespaces is the
  correct way to run them.
- `libperl-dev` and `python2-dev` had no runtime consumer. `google-pprof` is a
  perl script and runs on the base perl interpreter; verified `pprof --version`
  still works in the rebuilt image. python2 is EOL and unused.

End-to-end result, building the base image before and after (linux/arm64):

- before: 54 CRITICAL from the two kernel packages
- after:  0 CRITICAL from them; the rebuilt base image reports 2 CRITICAL, both
  CVE-2025-68121 in the Go stdlib of the `doris-debug`/`dorisctl` binaries copied
  from `apache/doris:debug-latest`, which is a separate image outside this repo

Verified the surviving tooling in the rebuilt image: `pprof`, `gdb`, `mysql`
client, JDK 17, and the `dorisctl`/`doris-debug` binaries, plus that no
`linux-libc-dev`/`linux-tools-common`/`libc6-dev` remain installed.

The base image tag moves to `base-6.1` and the fe/be/ms Dockerfiles are updated
in lockstep, matching how apache#59292 moved base-5.0 -> base-6.0.

### Release note

Removed kernel-header and -dev packages (`linux-tools-realtime`, `bpfcc-tools`,
`linux-headers-realtime`, `libperl-dev`, `python2-dev`) from the Doris runtime
base image, eliminating 54 non-actionable CRITICAL CVE findings per image. `perf`
and the BCC tools are no longer present; run them from a debug sidecar sharing
the target container's namespaces instead. `pprof`, `gdb`, and `strace` are
unaffected.

### Check List (For Author)

- Test: Manual test - built `Dockerfile_base` for linux/arm64 before and after,
  scanned both with trivy to confirm the 54 kernel-package criticals are gone,
  and smoke-tested `pprof`, `gdb`, `mysql`, JDK 17, and the debug binaries in the
  rebuilt image. Also confirmed the transitive pull-in attribution with
  `apt-get install -s` per package. No regression test applies: this repo has no
  CI that builds the runtime images.
- Behavior changed: Yes - `perf` and the BCC tools are no longer shipped in the
  runtime image, for the reasons above.
- Does this need documentation: No