feat: [#252] implement dynamic image detection for vulnerability scanning

[josecelano]

Closes #252

Summary

Implements dynamic Docker image detection for the Trivy vulnerability scanning workflow. Instead of a hardcoded image list, the workflow now builds the deployer CLI, creates a minimal environment, and extracts the image list from the show command JSON output — ensuring the scan matrix automatically updates whenever an image constant changes.

Changes

Domain Model

• Added DockerImage value object (src/shared/docker_image.rs) with repository, tag, and full_reference() method
• Added docker_image() static methods with constants to TrackerConfig, MysqlServiceConfig, PrometheusConfig, and GrafanaConfig
• Added docker_image() delegation in DatabaseConfig (returns Some for MySQL, None for SQLite)

Infrastructure / Template

• Added image: String field to all four service context structs (TrackerServiceContext, MysqlServiceContext, PrometheusServiceContext, GrafanaServiceContext)
• Updated templates/docker-compose/docker-compose.yml.tera to use {{ tracker.image }}, {{ mysql.image }}, {{ prometheus.image }}, {{ grafana.image }} instead of hardcoded strings

Show Command

• Added DockerImagesInfo DTO (extracted to its own module show/info/docker_images.rs)
• Added docker_images: DockerImagesInfo field to EnvironmentInfo (always populated, not optional)
• Updated show handler to populate docker_images from domain config constants
• Updated text view to render a Docker Images section
• Updated JSON output — docker_images is now present in all states

GitHub Actions Workflow

• Added extract-images job: builds CLI → creates minimal env → runs show ci-images → pipes JSON to jq to produce image array
• Updated scan-third-party-images to use ${{ fromJson(needs.extract-images.outputs.images) }} matrix (fully dynamic)
• Replaced 5 hardcoded third-party SARIF upload steps with a single bash loop in upload-sarif-results
• Added src/** to workflow trigger paths so image constant changes trigger re-scans

Verification

All commands tested locally:

./target/release/torrust-tracker-deployer --working-dir /tmp/ci-workspace create environment --env-file /tmp/ci-images-env.json
./target/release/torrust-tracker-deployer --working-dir /tmp/ci-workspace show ci-images
# jq output: ["torrust/tracker:develop","mysql:8.4","prom/prometheus:v3.5.0","grafana/grafana:12.3.1","caddy:2.10"]

Pre-commit checks: ✅ 425/425 tests pass, all linters pass.

[josecelano]

ACK af3fc7b