Add support for security options in CNB builder container config

Closes gh-37479

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/docs/asciidoc/packaging-oci-image.adoc

@@ -223,6 +223,11 @@ The value must be a string in the ISO 8601 instant format, or `now` to use the c
 Application contents will also be in this location in the generated image.
 | `/workspace`
 
+| `securityOptions`
+| `--securityOptions`
+| https://docs.docker.com/engine/reference/run/#security-configuration[Security options] that will be applied to the builder container, provided as an array of string values
+| `["label=disable"]`
+
 |===
 
 NOTE: The plugin detects the target Java compatibility of the project using the JavaPlugin's `targetCompatibility` property.

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/tasks/bundling/BootBuildImage.java

@@ -302,6 +302,15 @@ public abstract class BootBuildImage extends DefaultTask {
 	@Option(option = "applicationDirectory", description = "The directory containing application content in the image")
 	public abstract Property<String> getApplicationDirectory();
 
+	/**
+	 * Returns the security options that will be applied to the builder container.
+	 * @return the security options
+	 */
+	@Input
+	@Optional
+	@Option(option = "securityOptions", description = "Security options that will be applied to the builder container")
+	public abstract ListProperty<String> getSecurityOptions();
+
 	/**
 	 * Returns the Docker configuration the builder will use.
 	 * @return docker configuration.
@@ -349,6 +358,7 @@ public abstract class BootBuildImage extends DefaultTask {
 		request = request.withNetwork(getNetwork().getOrNull());
 		request = customizeCreatedDate(request);
 		request = customizeApplicationDirectory(request);
+		request = customizeSecurityOptions(request);
 		return request;
 	}
 
@@ -450,4 +460,12 @@ public abstract class BootBuildImage extends DefaultTask {
 		return request;
 	}
 
+	private BuildRequest customizeSecurityOptions(BuildRequest request) {
+		List<String> securityOptions = getSecurityOptions().getOrNull();
+		if (securityOptions != null) {
+			return request.withSecurityOptions(securityOptions);
+		}
+		return request;
+	}
+
 }

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/test/java/org/springframework/boot/gradle/tasks/bundling/BootBuildImageIntegrationTests.java

@@ -368,6 +368,19 @@ class BootBuildImageIntegrationTests {
 		removeImages(projectName);
 	}
 
+	@TestTemplate
+	void buildsImageWithEmptySecurityOptions() throws IOException {
+		writeMainClass();
+		writeLongNameResource();
+		BuildResult result = this.gradleBuild.build("bootBuildImage");
+		String projectName = this.gradleBuild.getProjectDir().getName();
+		assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
+		assertThat(result.getOutput()).contains("docker.io/library/" + projectName);
+		assertThat(result.getOutput()).contains("---> Test Info buildpack building");
+		assertThat(result.getOutput()).contains("---> Test Info buildpack done");
+		removeImages(projectName);
+	}
+
 	@TestTemplate
 	void failsWithInvalidCreatedDate() throws IOException {
 		writeMainClass();

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/test/resources/org/springframework/boot/gradle/tasks/bundling/BootBuildImageIntegrationTests-buildsImageWithEmptySecurityOptions.gradle

@@ -0,0 +1,15 @@
+plugins {
+	id 'java'
+	id 'org.springframework.boot' version '{version}'
+}
+
+java {
+	sourceCompatibility = '1.8'
+	targetCompatibility = '1.8'
+}
+
+bootBuildImage {
+	builder = "projects.registry.vmware.com/springboot/spring-boot-cnb-builder:0.0.2"
+	pullPolicy = "IF_NOT_PRESENT"
+	securityOptions = []
+}