chore(deps): update ferrlabs/.github digest to 2718959

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/.github (changelog)	workflow	digest	af8854d → 2718959

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Digest bump for FerrLabs/.github, three upstream commits between af8854d and 2718959:

1. reusable-docker-build.yml: cosign signing no longer waits on the trivy job (needs: [build, trivy] → needs: build). Behavior change only, signature now happens even if the CVE scan fails; no input/output/secret contract change.
2. reusable-ferrflow-release.yml: adds CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_FERRLABS_REGISTRY_TOKEN }} to the two FerrFlow steps.
3. default.json (shared renovate config): keeps chart majors out of the FerrLabs charts group. This repo's renovate.json extends github>FerrLabs/.github, so it applies, but only to future Renovate PRs, not to this one or to CI.

None of the four call sites in this repo (docker.yml ×4, release.yml, security-scan.yml, sonarqube.yml) need any change to match the new interface, all still call the workflows with the same with/secrets: inherit shape.

Nit: release.yml uses secrets: inherit, so the new CARGO_REGISTRY_TOKEN env var will pick up CARGO_FERRLABS_REGISTRY_TOKEN automatically if that secret is defined at org/repo level. I can't check secret existence from here; worth confirming before the next non-dry-run release, since a missing token would only surface as a crates.io auth failure at publish time, not in this PR's checks.

CI: everything that has completed so far is green (Conventional commits, Coverage-adjacent jobs, Secrets+CVE scans, hadolint, Helm chart, Check Site); nothing has failed. No job in this PR's checks exercises reusable-ferrflow-release.yml since that only runs on release, not on PR events.