PRODSEC-4321: [supply-chain] Replace third-party URLs with Artifactory

[sfc-gh-jdrozdowicz]

Summary

Following the recent axios supply-chain attack, the Product Security Team is working to eliminate dependencies on third-party package sources and ensure all packages are downloaded through Snowflake Artifactory. This reduces the risk of compromised upstream packages reaching our build and runtime environments.

Changes

• ci/build_docker.sh - replaced pip install URLs with Artifactory proxy
• ci/docker/connector_build/Dockerfile - replaced pip index URL with Artifactory
• ci/docker/connector_test/Dockerfile - replaced pip index URL with Artifactory
• ci/docker/connector_test_fips/Dockerfile - replaced pip index URL with Artifactory
• ci/docker/connector_test_rockylinux9/Dockerfile - replaced pip index URL with Artifactory
• ci/test_darwin.sh - replaced pip install source with Artifactory
• ci/test_docker.sh - replaced pip install source with Artifactory
• ci/test_fips.sh - replaced direct PyPI/third-party URLs with Artifactory
• ci/test_linux.sh - replaced direct PyPI/third-party URLs with Artifactory
• ci/test_revocation.sh - replaced direct PyPI/third-party URLs with Artifactory
• ci/test_rockylinux9.sh - replaced direct PyPI/third-party URLs with Artifactory
• ci/test_rockylinux9_docker.sh - replaced pip install source with Artifactory
• ci/test_wif.sh - replaced pip install source with Artifactory
• ci/test_windows.bat - replaced pip install source with Artifactory
• prober/Dockerfile - replaced pip index URL with Artifactory

Why

Pulling packages directly from public registries (PyPI, PyTorch, Go module proxy) bypasses our artifact scanning and caching layer. If an attacker compromises an upstream package - as happened with axios - the malicious version would be fetched directly into our environments. Routing through Artifactory gives us a controlled checkpoint for vulnerability scanning and version caching.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[sfc-gh-jdrozdowicz]

Hi! 👋

The Security Foundation team is replacing third-party URLs with Snowflake Artifactory according to our company's security policies. This change ensures all dependencies are fetched through our controlled proxy rather than directly from public registries.

@sfc-gh-turbaszek @sfc-gh-akolodziejczyk — could you please review this PR? If you were chosen incorrectly, please add the appropriate person for reviewing it.

If you have any questions regarding this PR, please reach out on Slack to Jowita Drozdowicz.

Thank you!

---

⚠️ Note: This PR was created by an AI agent as part of an automated supply-chain security remediation effort. While the changes have been validated for correctness, AI agents can make mistakes. If you notice any issues, please report them to Jowita Drozdowicz so we can improve the process.