Release v3.14.0

What's Changed

• test: add container-level entrypoint tests (bats) by @dbelyaev in #550
• test: drop workflow jobs superseded by the bats suite by @dbelyaev in #551
• fix: validate checkstyle_version, pin the bundled JAR by sha256 by @dbelyaev in #552
• fix: enforce HTTPS on all downloads, collapse Docker layers, merge nested if by @dbelyaev in #553
• test: cover the Checkstyle exit-code branch (254/255) by @dbelyaev in #554
• docs: document why the base image is pinned by tag AND digest by @dbelyaev in #555
• chore(deps): update eclipse-temurin:25.0.3_9-jre-alpine docker digest to 28db6fd by @renovate[bot] in #527

Full Changelog: v3.13...v3.14.0