Fix critical CVEs from daily vulnerability scan

[geropl]

Summary

Fixes the critical findings from the July 23 daily vulnerability scan by rebuilding the affected Caddy images on a pinned runtime base and removing npm's unused vulnerable dependency tree from production Node images.

Remediation

Affected images	Package	From	To	Advisory
dashboard, ide-proxy, proxy	caddy/caddy runtime / Alpine OpenSSL	floating 2.11.4-alpine; cached libcrypto3 / libssl3	2.11.4-alpine@sha256:ef2ad799…; rebuilt packages at 3.5.7-r0	OpenSSL critical set, including CVE-2026-34182
server, ws-manager-bridge	Node.js	builder 22.22.0, runtime 22.22.1	22.22.3	Base refresh
server, ws-manager-bridge	npm-bundled tar	6.2.1 / 7.4.3 (3 vulnerable copies per image)	removed from runtime	GHSA-23hp-3jrh-7fpw
gitpod-db	npm-bundled tar	7.5.11	removed from runtime	GHSA-23hp-3jrh-7fpw

npm/npx are not used by these production entrypoints: server and ws-manager-bridge invoke Node directly, while gitpod-db uses Yarn.

Validation

• Built the proxy Docker image through leeway and generated its SBOM; the resulting image has zero critical Grype findings.
• Built the server, ws-manager-bridge, and gitpod-db final Docker stages.
• Scanned flattened final Node filesystems with Grype: zero unignored critical findings.
• Verified all three Node images retain Node v22.22.3 and Yarn 1.22.22.
• Ran pre-commit run --files for all six changed Dockerfiles.

Local leeway SBOM export for Node images is limited by Docker failing to read an npx file from the upstream base layer while saving parent layers. The final filesystems were flattened and scanned successfully; CI uses a separate Docker environment.

Fixes CLC-2263

Workflow: https://github.com/gitpod-io/gitpod/actions/runs/29968804580

[ona-integrations]

Reviewed the changes. Implementation looks solid: good code quality and follows established patterns. No significant concerns. The Caddy base is digest-pinned consistently across the three proxy images (matching the repo's existing FROM ...@sha256 convention), and the npm/npx removal is scoped to the runtime stages while leaving builder tooling and Yarn intact.

Documentation review ran in docs-drift mode: this is a code-only change to component Dockerfiles with no user-visible behavior, API, config, or operational change, so no documentation updates are required.

Low-risk determination: Escalate to human review
This change does not meet all low-risk criteria or has review findings requiring human attention before merge.

• Size: pass — additions (19) + deletions (10) = 29 lines, well under the 1,000-line threshold.
• Protobuf: pass — No .proto files added or modified; all six changed files are Dockerfiles.
• Database migrations: pass — No migration files added or modified.
• Infrastructure/CI: pass — The changed files are application component build Dockerfiles (components/*/Dockerfile), not infrastructure-as-code, platform config, or CI workflow configuration (no Terraform, k8s/helm, or .github/workflows changes).
• Auth and authorisation: pass — No auth or access-control logic touched; changes are limited to base-image pins/versions and removal of unused npm tooling.
• Audit logging and monitoring: pass — No audit logging, metrics, tracing, alerting, or observability configuration affected.

Escalation reason: the breaking-change criterion could not be confidently cleared. This PR removes the npm/npx binaries from the production runtime image stages of server, ws-manager-bridge, and gitpod-db. The safety of that removal rests on the assertion that npm/npx are unused at runtime, which was not independently verified. A human should confirm no runtime or operational path depends on npm/npx before merging.