chore(superchain): add libffi-dev, explicitly install python3-dev (#3069

)

The `cryptography` Python package may require `libffi-dev` to be
available for installs on operating systems / architectures that are not
supported by `manylinux`. This appears to now be the case of Debian<11,
Python<3.8.

Having `libffi` on the image is going to alleviate this issue.

Also, moved the `rust` install to happen before the `python3` install,
as it is a logical dependency of `python` (it is only installed because
`cryptography` might need it).



---

By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license].

[Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0

superchain/Dockerfile

@@ -107,6 +107,7 @@ RUN apt-get update
                         git                                                                                             \
                         gnupg                                                                                           \
                         gzip                                                                                            \
+                        libffi-dev                                                                                      \
                         libicu63                                                                                        \
                         libssl-dev                                                                                      \
                         openssl                                                                                         \
@@ -125,14 +126,6 @@ RUN apt-key add /tmp/mono.asc && rm /tmp/mono.asc
   && apt-get -y install mono-devel                                                                                      \
   && rm -rf /var/lib/apt/lists/*
 
-# Install Python 3
-RUN apt-get update                                                                                                      \
-  && apt-get -y install python3 python3-pip python3-venv                                                                \
-  && python3 -m pip install --no-input --upgrade pip                                                                    \
-  && python3 -m pip install --no-input --upgrade awscli black setuptools twine wheel                                    \
-  && rm -rf $(pip cache dir)                                                                                            \
-  && rm -rf /var/lib/apt/lists/*
-
 # Install Rust (required for https://pypi.org/project/cryptography/ in certain circumstances... like ARM64 arch)
 ENV RUSTUP_HOME=/usr/local/rustup                                                                                       \
     CARGO_HOME=/usr/local/cargo
@@ -142,6 +135,14 @@ RUN set -eo pipefail
   && chmod -R a+rw ${CARGO_HOME}
 ENV PATH=$PATH:${CARGO_HOME}/bin
 
+# Install Python 3
+RUN apt-get update                                                                                                      \
+  && apt-get -y install python3 python3-dev python3-pip python3-venv                                                    \
+  && python3 -m pip install --no-input --upgrade pip                                                                    \
+  && python3 -m pip install --no-input --upgrade awscli black setuptools twine wheel                                    \
+  && rm -rf $(pip cache dir)                                                                                            \
+  && rm -rf /var/lib/apt/lists/*
+
 # Install JDK8 (Amazon Corretto 8)
 COPY superchain/gpg/corretto.asc /tmp/corretto.asc
 RUN apt-key add /tmp/corretto.asc && rm /tmp/corretto.asc                                                               \