Fix critical CVEs from daily vulnerability scan

[geropl]

Summary

• remove the unused curl package inherited from the Caddy runtime in dashboard, IDE proxy, and proxy images
• retain the existing Alpine security upgrade and required runtime packages
• reduce the shared runtime attack surface by removing curl and its now-unused libraries

Vulnerability remediation

Package	From	To	Critical vulnerabilities
curl	8.19.0-r0	removed	CVE-2026-8924, CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-9079, CVE-2026-10536, CVE-2026-11564, CVE-2026-11856

The daily scan reported the same eight critical findings in components/ide-proxy:docker, components/proxy:docker, and components/dashboard:docker. All three inherit curl from the same pinned Caddy Alpine runtime, but none use it in the final image.

Validation

• leeway build components/proxy:docker completed successfully using a temporary local registry
• the built custom Caddy binary reports v2.11.4 and starts successfully
• Grype reports 0 critical vulnerabilities in the rebuilt proxy image
• Dockerfile checks pass for all three affected images
• pre-commit run --files components/dashboard/leeway.Dockerfile components/ide-proxy/Dockerfile components/proxy/Dockerfile

Fixes CLC-2264

Workflow: https://github.com/gitpod-io/gitpod/actions/runs/30055829473

[ona-integrations]

Reviewed the changes. Implementation looks solid: good code quality, appropriate test coverage, and follows established patterns. No significant concerns.

The change cleanly removes the unused curl package from the shared Caddy Alpine runtime across all three images with a consistent approach, keeps the base images digest-pinned, and retains the required ca-certificates/bash packages in the proxy image — a targeted, low-surface-area CVE remediation.

Docs review: ran a docs-drift check (code-only PR); no documentation updates are needed since the change touches only internal runtime images with no user-visible, API, config, or operational surface.

Low-risk determination: Approved
This change meets all low-risk criteria under Ona's change management policy. A human engineer is still responsible for the merge, which constitutes the traceable approval for SOC 2 purposes.

• Size: additions (9) + deletions (4) = 13 lines total, far below the 1,000-line threshold ✓
• Protobuf: no .proto files added or modified ✓
• Database migrations: no migration files added or modified ✓
• Infrastructure/CI: only component runtime Dockerfiles changed (package removal), no infra/platform/CI config touched ✓
• Auth and authorisation: no auth or access-control logic affected (no RBAC, roles, permissions, scopes, policies, guards, ACLs, session handling) ✓
• Audit logging and monitoring: no audit logging, monitoring, metrics, tracing, alerting, or observability configuration affected ✓

[ona-integrations]

Low-risk determination: Approved. This CVE remediation removes the unused curl package from three Caddy runtime images with a consistent, minimal approach and no breaking changes. Meets all low-risk criteria under Ona's change management policy; a human engineer remains responsible for the merge.