fix(ci): add permissions and bump docker pipeline to v0.16.1

[mpastecki]

Add job-level permissions for docker_pipeline job.

Required by reusable_docker_pipeline.yml:

• contents: read - checkout access
• id-token: write - AWS OIDC authentication
• security-events: write - Trivy SARIF uploads

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

This PR updates the docker_pipeline job in the CI workflow to add explicit job-level permissions and upgrades the reusable Docker pipeline workflow from v0.13.4 to v0.16.1.

Changes:

• Added three explicit permissions (contents: read, id-token: write, security-events: write) required by the reusable workflow
• Removed packages: read permission (not needed for non-publishing CI builds)
• Bumped reusable_docker_pipeline version from v0.13.4 to v0.16.1
• Reordered workflow elements to follow GitHub Actions standard format (permissions before uses)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kirugan]

@mpastecki docker lint failed