Harden devcontainer: pin digests, guard SYS_ADMIN, fix mount filters#20

dguido merged 1 commit intomaintrailofbits/claude-code-devcontainer:mainfrom

hardening-cleanuptrailofbits/claude-code-devcontainer:hardening-cleanupCopy head branch name to clipboard