Update Dockerfile for best practices and CVE fixes

Update the Dockerfile to bring it closer to current container best practices while fixing multiple critical CVEs.

This pins Alpine 3.21 and Go 1.25.9 explicitly, installs the Go toolchain in the builder stage so the image no longer depends on an unavailable upstream golang tag, upgrades setuptools to pick up the CVE-2025-47273 fix, refreshes the yt-dlp installation path, and runs the final image as a non-root user.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>