build: harden docker image for scanner findings

[gildesmarais]

Summary

• pin the Ruby and Node base images by digest
• shrink the runtime image by copying only app runtime files and removing curl-based health checks
• prune Bundler cache and git metadata, remove unnecessary runtime XML packages, and upgrade runtime zlib

Verification

• docker compose -f .devcontainer/docker-compose.yml exec -T app make ready
• docker build -t html2rss/web-security-smoke -f Dockerfile .
• docker run --rm html2rss/web-security-smoke ruby -e 'require "nokogiri"; puts Nokogiri::VERSION_INFO.to_h'

Notes

• Nokogiri still loads correctly after removing Alpine runtime libxml2/libxslt packages.
• curl is no longer shipped in the final runtime image.
• An unrelated local change in AGENTS.md was left unstaged and is not part of this PR.

[Copilot]

Pull request overview

This PR hardens the project’s Docker image to address scanner findings by pinning base images, reducing the runtime footprint, and trimming build artifacts in the final image.

Changes:

• Pin Ruby and Node base images by digest and use the pinned Node image for the frontend build stage.
• Reduce image size by cleaning Bundler artifacts and copying only runtime app files into the final stage.
• Remove curl-based health checks and replace them with a Ruby Net::HTTP healthcheck; drop several runtime APK packages and upgrade zlib.

---

You can also share your feedback on Copilot code review. Take the survey.