Improve Docker CI for PRs and add manual release workflow

[wborn]

Summary

Refactor the Docker image workflow to better support pull requests, manual dispatches, releases, and multi-architecture publishing.

This change also adds container vulnerability scanning for the base image and keeps the workflow usable in forks by avoiding DockerHub publishing on PR builds.

Changes

• add pull_request support for build validation
• refactor duplicated amd64 and arm64 jobs into a matrix build
• support manual workflow_dispatch runs on main or on a tag
• treat tag-based manual runs as versioned builds
• treat main branch runs as develop builds
• keep DockerHub login and push disabled for PRs
• create multi-arch manifests for both develop and versioned release tags
• add Grype scanning for the base Docker image
• upload SARIF results for non-PR runs
• only upload SARIF for workflow_dispatch when run on main
• keep the existing per-arch slim-image flow
• add Buildx cache configuration
• pin GitHub Actions to commit SHAs

Behavior

Pull requests

• build amd64 and arm64 images
• scan the base image with Grype
• do not log in to DockerHub
• do not push images
• do not create manifests
• do not upload SARIF

Push to main

• build develop-amd64 and develop-arm64
• scan the base image with Grype
• upload SARIF results
• push arch-specific images
• create and push develop and develop-slim multi-arch manifests

Release

• build versioned amd64 and arm64 images
• scan the base image with Grype
• upload SARIF results
• push arch-specific images
• create and push versioned and latest multi-arch manifests

Manual dispatch

• allowed on main or on a tag
• on main, behaves like a develop build
• on a tag, behaves like a versioned release build
• fails fast if run on any other ref

Why

This makes the workflow more useful for contributors and forks by allowing PR validation without requiring publish credentials.

It also improves maintainability by deduplicating the architecture-specific jobs and centralizing the image tag/version logic.

Finally, it adds image vulnerability scanning so issues in the base image are detected during CI before publishing.

Notes

• only the base image is scanned; slim images are not scanned separately
• Markdown-only changes do not trigger the workflow on push and pull_request
• manual dispatches are intentionally restricted to main and tags to avoid publishing unintended temporary tags