Percona and Chainguard aim to cut CVE patching and reduce overhead with secure-by-default images for open-source databases.