ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0

[dependabot]

Summary

Update Docker Buildx setup from 4.2.0 to 4.3.0 for container builds, validation, and release workflows.

Changes

• Update all five uses to the immutable v4.3.0 commit, 37fe631027851001ddb9b187196cc803df7f5f0e.
• Reviewed the upstream release, the exact version comparison, shipped action metadata and source, and the actions-toolkit 0.92.0–0.95.0 changes. Inputs, defaults, outputs, Node 24 runtime, and setup/cleanup entrypoints are unchanged.
• Existing workflows use the default builder configuration. No compatibility code or obsolete workaround needs changing.

Testing

• git diff --check passed.
• Compared old/new action metadata and entrypoint source: identical.
• Current-head CI: 44 checks passed; two conditional jobs were skipped. All required checks passed.
• Inspected container job logs: the new action SHA ran successfully on hosted x64 and arm64 runners, using Buildx 0.37.0. Container builds, sandbox/credential checks, Compose validation, and findings-service smoke tests passed.
• Reused the passing CI evidence for this action-only change; no application tests were added or rerun locally.

Risk and rollout

The change updates bundled action dependencies and preserves the existing action interface. It applies to subsequent container workflows. Release publication remains gated by the existing approval and verification jobs; publication was not triggered for this review. Reverting these pins restores 4.2.0 if needed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Reviewed head 5b8172ad05c30f19ee0c1eb543c989f21a926cd9 against current main. All five pins resolve to the upstream 4.3.0 release; action inputs, defaults, Node 24 runtime, setup and cleanup source remain compatible. No code simplification or compatibility fix is needed.

The fresh CI run is successful: 42 jobs passed and two conditional jobs were skipped. The Windows npm-install timeout cleared after retrying only failed checks. Container build and both architecture validations passed. All required current-head checks pass, no unresolved review threads remain, and the public disclosure review is complete.