add dockerfile and workflows

[espenhgn]

Closes #23.
This should build the Docker container using the pyproject.toml files on PR/commits. Pushing artefacts should happen if version tags (pattern "v1.2.3") are pushed on the working branch

[vbabenko97]

Three things to fix before merging, plus two small ones.

1. The installed image lacks required runtime modules and configuration. pip install . installs only the five packages listed in pyproject; flare/, scripts/, data/, sites.yaml and the example specs are not installed, and rm -rf /tmp/* then deletes the checkout. The test step passes only because -v ${{ github.workspace }}:/home mounts the repository over the working directory, so pytest runs the source tree, not the image.
2. COPY . . with no .dockerignore. A local build after scripts/provision.sh copies flare/workspace (mTLS credentials) and .venv into a layer, and the later rm -rf does not remove them from the image history. Exclude credentials, local environments, generated outputs, and Git metadata from the build context.
3. fail-build: false makes the scan advisory. The v0.0.1 run reported Critical openssl CVEs and still pushed the image. Either fail on critical or record in the workflow why not.

Minor: pytest is already in the dev extra and does not belong in runtime dependencies, and the data/ground_truth.json changes are last-digit float noise from regeneration; dropping them also removes the merge conflict.

[vbabenko97]

Heads-up: I pushed 34296d4 to this branch. It only renames the four container-image references (LATEST_TAG and the metadata image name in both workflows) from bifrost to heimdall, to match the project rename in fffe718. The repository name itself is unchanged for now.

Note that no CI ran on it: the CI workflow triggers on pull_request, and GitHub does not build the merge ref while the PR conflicts with main. The conflict is data/ground_truth.json only. Reverting that file to main's version (the changes are last-digit float noise from regeneration) restores mergeability and lets CI run on the PR again.