Pin the Node.js version via `.config.rde.qovery.yml` and harden the NodeSource install

[jpetitcolas]

Problem

In the template Dockerfile, Node.js is installed by piping the NodeSource setup script into bash:

# Node.js 22 LTS
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

Two weaknesses:

1. Loose version pin. setup_22.x pins only the major version — the subsequent apt-get install nodejs pulls the latest 22.x available at build time, so the exact Node minor/patch varies build-to-build with no record of what shipped.
2. No integrity check. The setup script is fetched and executed via curl … | bash with no checksum, so a changed or compromised script runs undetected.

Proposed change

Declare the Node.js version in .config.rde.qovery.yml — the documented source of truth for component versions in the RDE install flow (see Qovery/documentation#143). The nodejs key accepts a version string (default 22):

# .config.rde.qovery.yml
nodejs: "22"   # pin to the intended major; pin tighter if the install path allows

Where the install path allows, also tighten reproducibility and integrity: pin the installed nodejs apt package to an exact version, and prefer a verified keyring-based NodeSource apt setup over piping the setup script straight into bash.

Acceptance criteria

• The Node.js version is declared in .config.rde.qovery.yml, not hardcoded inline in the Dockerfile
• The installed Node.js version is reproducible across builds (pinned as tightly as the install path supports)
• The NodeSource setup is not executed from an unverified curl … | bash (use a checksum or keyring-verified apt source)
• Image builds successfully and node/npm run in the container