fix: pin alpine base image, run as non-root, harden checkout credentials

[darkweaver87]

Motivation

Resolve piceus's Aikido IaC and container SAST findings. Both Dockerfiles used FROM alpine (unpinned latest) and ran as root; they now pin the alpine base to a digest and run as user 65534 (nobody, matching production). The CI actions/checkout steps set persist-credentials: false.

The three pkg/sources file-inclusion SAST findings are intentionally left out of this PR — piceus reads untrusted third-party plugin repos, so those need a dedicated review and will be handled separately.

• Docker container runs as root: https://app.aikido.dev/queue?issue_id_filter=18158985
• Automatic upgrades of base Docker images: https://app.aikido.dev/queue?issue_id_filter=18158999
• actions/checkout persists Git credentials: https://app.aikido.dev/queue?issue_id_filter=33654896

[bpsoraggi]

LGTM