chore(ci): build kopia with -trimpath (#4983)

Rationale: move towards reproducible (hermetic) builds.

The `-trimpath` flag removes absolute file system paths
from the resulting executables.

- add `-trimpath` to `KOPIA_BUILD_FLAGS`
- add `-trimpath` to `goreleaser` config
- move `KOPIA_BUILD_*` var defs to `Makefile`

.goreleaser.yml

@@ -11,6 +11,8 @@ builds:
     - amd64
     - arm
     - arm64
+  flags:
+    - -trimpath
   ldflags:
   - -s -w -X "github.com/kopia/kopia/repo.BuildVersion={{.Version}}" -X "github.com/kopia/kopia/repo.BuildInfo={{.Commit}}" -X "github.com/kopia/kopia/repo.BuildGitHubRepo={{.Env.GITHUB_REPOSITORY}}"
 release:

Makefile

@@ -16,6 +16,9 @@ all:
 
 include tools/tools.mk
 
+KOPIA_BUILD_TAGS=
+KOPIA_BUILD_FLAGS=-trimpath -ldflags "-s -w -X github.com/kopia/kopia/repo.BuildVersion=$(KOPIA_VERSION_NO_PREFIX) -X github.com/kopia/kopia/repo.BuildInfo=$(shell git rev-parse HEAD) -X github.com/kopia/kopia/repo.BuildGitHubRepo=$(GITHUB_REPOSITORY)"
+
 kopia_ui_embedded_exe=dist/kopia_$(GOOS)_$(GOARCH)/kopia$(exe_suffix)
 
 ifeq ($(GOOS),darwin)

tools/tools.mk

@@ -261,9 +261,6 @@ export KOPIA_VERSION_NO_PREFIX=$(KOPIA_VERSION:v%=%)
 export REACT_APP_SHORT_VERSION_INFO:=$(KOPIA_VERSION)
 export REACT_APP_FULL_VERSION_INFO:=$(KOPIA_VERSION) built on $(date_full) $(hostname)
 
-KOPIA_BUILD_TAGS=
-KOPIA_BUILD_FLAGS=-ldflags "-s -w -X github.com/kopia/kopia/repo.BuildVersion=$(KOPIA_VERSION_NO_PREFIX) -X github.com/kopia/kopia/repo.BuildInfo=$(shell git rev-parse HEAD) -X github.com/kopia/kopia/repo.BuildGitHubRepo=$(GITHUB_REPOSITORY)"
-
 clean-tools:
 	rm -rf $(TOOLS_DIR)