Workbench: Add pipx.

workbench/Dockerfile

 # hadolint ignore=DL3007
 FROM registry.shore.co.il/toolbx:latest
 SHELL ["/bin/bash", "-o", "pipefail", "-xc"]
+ENV PIPX_HOME /opt/pipx
+ENV PIPX_BIN_DIR /opt/pipx/bin
+ENV PATH /opt/pipx/bin:/usr/local/lib/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 # hadolint ignore=DL3008,DL3013,DL3016,DL3027,DL4001
 RUN apt-get update && \
     curl --location --silent --fail --show-error https://github.com/kubernetes/kompose/releases/download/v1.26.1/kompose_1.26.1_amd64.deb --output /tmp/kompose.deb && \
@@ -204,6 +207,7 @@ RUN apt-get update && \
         pgcli \
         pip-tools \
         pipenv \
+        pipx \
         poetry \
         pre-commit \
         protobuf \
@@ -234,7 +238,6 @@ RUN apt-get update && \
         @playwright/test \
     && \
     export GOPATH=/usr/local/lib/go && \
-    export PATH="$GOPATH/bin:$PATH" && \
     mkdir "$GOPATH" && \
     export GO111MODULE=on && \
     go install github.com/giantswarm/semver-bump@latest && \
@@ -282,13 +285,12 @@ RUN apt-get update && \
     wget https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem  -qO - | \
         awk '/-----BEGIN[A-Z0-9 ]*CERTIFICATE-----/ {n++} n > 0 {print > ("/usr/local/share/ca-certificates/rds-" (1+n) ".crt")}' && \
     update-ca-certificates && \
-    echo "export PATH=$GOPATH/bin:\$PATH" > /etc/profile.d/workbench.sh && \
+    echo "export PATH=$PIPX_BIN_DIR:$GOPATH/bin:\$PATH" > /etc/profile.d/workbench.sh && \
     # pragma: allowlist nextline secret
     rm /etc/ssh/ssh_host_* && \
     rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/* ~/.cache/*
 COPY --chown=root:root bash_completion.d/* /etc/bash_completion.d/
 COPY --chown=root:root bin/* /usr/local/bin/
-ENV PATH /usr/local/lib/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 ENV ASDF_DIR /opt/asdf
 VOLUME /run/sshd
 CMD ["/bin/bash"]