Upgrade Node 24/26 patching libssl3/libcrypto3 CVEs

[Copilot]

Description

PR #147 fails because Alpine 3.24's bundled libssl3/libcrypto3 (3.5.7-r0) carries fixable CVEs (CVE-2026-14456, -14457, -18798, -54874, -63072 through -63076, -75803), blocking Grype/Trivy in the build-images (production, ...) jobs. A fix (3.5.8-r0) is already published in Alpine's v3.24/main repo, so per IMAGE_SCANNING.md policy these must be patched, not added to the ignore lists.

• CVE fix: pin libssl3>=3.5.8 in the Dockerfile's apk add line (pulls in matching fixed libcrypto3)
• Version bump: carried over PR Update base image: 24,26 #147's Node.js base image bump so the fix applies to the build that's currently failing
  • Node 24: 24.20.0
  • Node 26: 26.8.1
  • Node 22: 22.23.2
• Docs: fixed a README table alignment nit

RUN apk add --no-cache tini ca-certificates 'libssl3>=3.5.8' \
    && npm install -g --ignore-scripts --prefix=/usr/local "npm@${NPM_VERSION}" \
    && npm cache clean --force

Checklist:

• I have ensured the Defra version in the JOB.env file matches that in the Dockerfile
• I have ensured the Node.js versions in the image-matrix.json match the Dockerfile and the table in the README.md
• I have added newly ignored vulnerabilities to the POLICY_CONFIGURATION.md — n/a, no new ignores added; the CVEs above are patched directly instead
• I have checked if previously identified vulnerabilities have been patched, and can be removed from the .grype.yaml, .trivyignore and POLICY_CONFIGURATION.md files — both files remain empty, nothing to remove

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud