Add Checkov and Hadolint heads; DNS option for self-hosted runners

[satsura]

Brings Cerberus to parity with the DefectDojo pipeline it is meant to replace, which runs five scanners — we had three.

• Checkov (IaC misconfig: Terraform, CloudFormation, k8s, Dockerfile) and Hadolint (every Dockerfile in the tree) are now first-class heads, enabled by default
• dns input on the action: self-hosted runners can sit behind a VPN resolver their containers cannot reach — without explicit DNS, Semgrep cannot fetch its rules and Trivy cannot fetch its vulnerability database, and both quietly produce an empty report. The existing DefectDojo workflow works around this with --dns 1.1.1.1 --dns 8.8.8.8; we make it configurable
• README documents fetch-depth: 0 (Gitleaks scans the whole history) and the self-hosted DNS caveat

Details worth knowing, found by running them:

• Checkov writes results_sarif.sarif (not results.sarif) into --output-file-path, and exits non-zero whenever it finds anything — the runner prefers the report over the exit code
• Hadolint takes files rather than a directory and writes to stdout, so a repo with no Dockerfile now gets a valid empty report instead of a scanner failure

Verified with the image against a local tracker: all five heads run and report (12 Trivy, 8 Hadolint, 4 Checkov, 3 Gitleaks, 2 Semgrep = 29 findings), a repeat scan reports 0 new / 29 known. That run also surfaced a second fingerprint-collision bug on the tracker side (Semgrep OSS emits a placeholder fingerprint) — fixed in startmatter/k#334.