fix(image): install at build instead of runtime

[VERNIERELoic]

Summary

Reworks the image so that everything is installed and configured at build time, and the container no longer mutates itself at startup.

• No runtime install/config: docker-entrypoint.sh and docker-entrypoint.d/* (apt, chown, install, update, plugins) are removed. Apache runs directly as PID 1 (apache2 -D FOREGROUND).
• Plugins baked into the image via the ITSMNG_PLUGINS build arg (Debian packages itsm-ng-plugin-*); ITSMNG_APT_VERSION pins the itsm-ng package.
• DB config from environment: /etc/itsm-ng/config_db.php reads MARIADB_* (with _FILE variants for secrets, plus optional TLS).
• Rootless & hardened: UID 1000 / group 0, port 8080, supports arbitrary UID, readOnlyRootFilesystem and the Kubernetes PSA restricted profile. Only /var/lib/itsm-ng is persistent; /tmp and /run/apache2 can be tmpfs.
• Explicit one-shot commands instead of boot-time scripts:
  • itsmng-init: creates the data tree, waits for the DB, installs or migrates the schema (idempotent)
  • itsmng-cron: runs one pass of scheduled tasks
  • itsmng-console: wrapper around bin/console
• Single image for all roles: the separate cron/ image is dropped; CI still publishes *-cron tags as aliases for compatibility.
• Tooling: compose.yaml (MariaDB + init + web + cron) with .env.example, docker-bake.hcl, new Makefile, .hadolint.yaml, /healthz healthcheck.
• Kubernetes example in deploy/kubernetes/ (Deployment, Service, PVC, init Job, CronJob, kustomization).
• CI: lint job (hadolint + shellcheck), builds on PRs with a smoke test (arbitrary UID, read-only, no caps), tags via metadata-action, SBOM + provenance attestations on release.
• README updated accordingly.

Test plan

• make lint
• make build
• docker compose up -d in latest/ → init completes, app reachable on http://localhost:8080
• docker compose run --rm cron
• CI smoke test passes on this PR