Pin Docker base image digests for supply chain security

[dash14]

Summary

• Pin all Dockerfile base images using manifest list digests (@sha256:...) to prevent silent image replacement while maintaining multi-architecture support
• Pin alpine:latest to alpine:3.23 and nginx:alpine to nginx:stable-alpine3.23-slim to avoid floating tags
• Add ARG BUILDKIT_DIGEST and ARG ALPINE_DIGEST to docker/Dockerfile for build-time override

Changed files

• docker/Dockerfile — Add digest ARGs, pin alpine and moby/buildkit
• test/Dockerfile.audit — Pin alpine:3.23 with digest
• test/Dockerfile.restrict — Pin alpine:3.23 with digest
• test/test-dns/Dockerfile — Pin alpine:3.23 with digest
• test/test-server/Dockerfile — Pin nginx:stable-alpine3.23-slim with digest