ci: pin cyrus-docker-test-server to last known-good digest

The cyrusimap/cyrus-docker-test-server image was rebuilt on 2026-04-03
with a multi-stage slim build that broke CalDAV startup: the httpd
module never comes up on port 8080, causing the health check to fail
before CI can even run.

Pin to the digest that was current on 2026-03-30 (confirmed passing in
GitHub Actions run 23748898521) until the upstream image is fixed.

Author: tobixen

.github/workflows/tests.yaml

@@ -40,7 +40,10 @@ jobs:
           --health-retries 5
           --health-start-period 60s
       cyrus:
-        image: ghcr.io/cyrusimap/cyrus-docker-test-server:latest
+        # Pinned to last known-good build (pre-April-2026 multi-stage rebuild
+        # that broke CalDAV startup). Unpin once upstream is fixed.
+        # Working digest confirmed in CI run 23748898521 (2026-03-30).
+        image: ghcr.io/cyrusimap/cyrus-docker-test-server@sha256:d639a9116691a7a1c875073486c419d60843e5ef8e32e65c5ef56283874dbf2c
         ports:
           - 8802:8080
           - 8001:8001