feat(docker): pin fork sources in the toolchain Dockerfile

The base emscripten/emsdk image is now pinned by digest upstream (6.0.2); this pins the two
bugra9 forks the image layers on top, which were still fetched from moving branches:
- libembind.js pinned to bugra9/emscripten commit 583984a + sha256-verified.
- bugra9/swig pinned to commit 1b6501a + sha256-verified (archive fetched by commit, not branch),
  so a moved branch or tampered CDN response fails the build instead of injecting other code.

Validated with 'docker build --check'. Takes effect on the next image rebuild — after building
and pushing @cpp.js/core-docker, run 'node scripts/pin-docker-image.js' to re-pin the resulting
digest in pullDockerImage.js.

Author: bugra9

cppjs-core/cppjs-core-docker/Dockerfile

@@ -1,3 +1,5 @@
+# Pinned by digest, not just tag, so a re-pushed emscripten/emsdk tag can't change the base
+# toolchain. Bump the digest together with the tag (docker manifest inspect emscripten/emsdk:<tag>).
 FROM --platform=linux/amd64 emscripten/emsdk:6.0.2@sha256:644883f58ca15c38c8be59b3a727ba0eff347729bc31d50a3348a6c9ed92bc07
 
 RUN apt-get update
@@ -21,21 +23,30 @@ RUN wget https://dl.google.com/android/repository/commandlinetools-linux-1311475
     mkdir -p /root/.android/ && touch /root/.android/repositories.cfg
 
 WORKDIR /emsdk/upstream/emscripten/src/lib
-RUN wget https://raw.githubusercontent.com/bugra9/emscripten/embind-overloading-support/src/lib/libembind.js -O libembind.js
+# Pinned to bugra9/emscripten commit 583984a (branch embind-overloading-support) + verified by
+# sha256 so a moved branch or tampered CDN response can't inject a different libembind.js.
+RUN wget https://raw.githubusercontent.com/bugra9/emscripten/583984a6c8feca8953f033e0bddd2d566b03fe86/src/lib/libembind.js -O libembind.js && \
+    echo "589aa78e3e6781298e575ef7d5971e0cc22ebc4a1c959af2c7d499052734fea8  libembind.js" | sha256sum -c -
 
 WORKDIR /emsdk/upstream/emscripten
 RUN sed -i 's/smart_ptr<SmartPtr>(smartPtrName);/ /g' ./system/include/emscripten/bind.h;
 RUN sed -i 's/smart_ptr<SmartPtr>(smartPtrName);/ /g' ./cache/sysroot/include/emscripten/bind.h;
 
 WORKDIR /home/emscripten
-RUN wget https://github.com/bugra9/swig/archive/refs/heads/add-embind-support.zip
-RUN unzip add-embind-support.zip
-
-WORKDIR /home/emscripten/swig-add-embind-support
+# Pinned to bugra9/swig commit 1b6501a (branch add-embind-support) + verified by sha256. GitHub
+# source archives are usually but not guaranteed byte-stable; if this ever fails on rebuild,
+# re-fetch the archive and refresh the sha256 (the commit in the URL fixes the source tree).
+RUN wget https://github.com/bugra9/swig/archive/1b6501ab958ac581229f765f30393f6119dd3e0e.zip -O swig.zip && \
+    echo "744d1f3a7cd9db687e642a505b282c46b0f1544bb6395284f217174b68f0aee8  swig.zip" | sha256sum -c - && \
+    unzip swig.zip && \
+    mv swig-1b6501ab958ac581229f765f30393f6119dd3e0e swig-src && \
+    rm swig.zip
+
+WORKDIR /home/emscripten/swig-src
 RUN apt-get install -y automake libpcre2-dev libbison-dev
 RUN cmake .
 RUN make
 RUN make install
 
 WORKDIR /home/emscripten
-RUN rm -rf add-embind-support.zip swig-add-embind-support
+RUN rm -rf swig-src