Cover Your Base Images: How Early Development Choices Impact Security