Migrate all scanner base images from UBI8/RHEL8 to UBI9/RHEL9:

Konflux base images:
- Builder: openshift-golang-builder:rhel_9_golang_1.25
- Scanner runtime: ubi9-minimal
- Scanner DB: rhel9/postgresql-15

Non-Konflux base images:
- Scanner: ubi9-minimal
- Scanner DB: ubi9 / ubi9-minimal
- Vulnerabilities: ubi9-minimal

Other updates:
- Tekton CPE labels: el8 -> el9
- rpms.lock.yaml: xz updated to RHEL 9 version (5.2.5-8.el9_0)
- rpms.rhel.repo: RHEL 8 repos -> RHEL 9 repos
- PostgreSQL download script: pg_rhel_major=9
- Image name labels: rhel8 -> rhel9
- microdnf install -y xz (explicit -y for UBI9 compatibility)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

In UBI9, update-ca-trust fails when running as an unprivileged user
(nobody:nobody) because it attempts to write to system-wide paths.
Use the -o flag to specify a user-writable output directory.

Also switch restore-all-dir-contents to use --no-clobber to avoid
overwriting CA trust files that were already updated at runtime.

See: https://bugzilla.redhat.com/show_bug.cgi?id=2241240

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…migration

# Conflicts:
#	image/db/rhel/konflux.Dockerfile