fix: upgrade Alpine packages to resolve CVEs in musl-utils and zlib (#1114)

Adds `apk upgrade --no-cache` to the runner stage to pull in patched
versions of musl-utils (>=1.2.5-r23) and zlib (>=1.3.2-r0), fixing:
- CVE-2026-40200 (HIGH) - musl arbitrary code execution
- CVE-2026-6042 (MEDIUM) - musl denial of service
- CVE-2026-22184 (HIGH) - zlib buffer overflow
- CVE-2026-27171 (MEDIUM) - zlib denial of service

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: brendan-kellam

Dockerfile

@@ -180,7 +180,8 @@ ENV SOURCEBOT_LOG_LEVEL=info
 # ENV SOURCEBOT_TELEMETRY_DISABLED=1
 
 # Configure dependencies
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen curl perl jq redis postgresql16 postgresql16-contrib openssl util-linux unzip
+RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen curl perl jq redis postgresql16 postgresql16-contrib openssl util-linux unzip && \
+    apk upgrade --no-cache
 
 ARG UID=1500
 ARG GID=1500