add msquic to Debian Helix images

[wfurt]

This will use 2.1 bits published by MsQuic.

[mthalman]

Instead of needing to store the key locally, wouldn't it be better to follow the pattern that is documented here.

Suggested change

	COPY microsoft.asc /tmp
	RUN apt-key add /tmp/microsoft.asc \
	&& rm /tmp/microsoft.asc \
	&& apt-add-repository https://packages.microsoft.com/debian/10/prod \
	&& apt-get update \
	&& apt-get install -y libmsquic \
	&& rm -rf /var/lib/apt/lists/*
	RUN curl https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb -o packages-microsoft-prod.deb \
	&& dpkg -i packages-microsoft-prod.deb \
	&& rm packages-microsoft-prod.deb \
	&& apt-get update \
	&& apt-get install -y libmsquic \
	&& rm -rf /var/lib/apt/lists/*

[wfurt]

This problem with that is that it is vulnerable to chain attacks since there is no verification if the downloaded key is the correct one. To do that correctly, we would need to verify key fingerprint before using as trusted. That can be done but it takes extra steps. I can do that if you really want to avoid establishing trust via local key file @mthalman

My preference would be to make singe file for all containers but I did not figure out how to do that.
Since this is ASCII, we can possibly create it via echo/printf as well.

[mthalman]

Ok, this is fine. But if there's a vulnerable aspect to the official installation instructions to customers, we should probably get that addressed, yes?

[wfurt]

yes, there were also some errors for some distributions and we should perhaps update notes to include current/latest OS versions as well. I will take a look.