chore(deps): update docker-images (#1001)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| caddy |  | digest | `25cdc84` → `af5fdcd` |
| gcr.io/distroless/static-debian12 | final | digest | `20bc6c0` →
`9c346e4` |
| golang | stage | digest | `b54cbf5` → `32c0e6e` |
| postgres |  | digest | `7848165` → `4aabea7` |

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/micasa-dev/micasa).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->


Manual follow-up: 43c6de0 restores the PR checks after CI drift by
allowing Ubuntu's mirror-list and default archive hosts in the
harden-runner policy, bumping the scoped Go override to 1.26.4 for
GO-2026-5037 and GO-2026-5039, and moving secret scanning to
step-security/trufflehog-action so the workflow matches the org
selected-actions policy. Refs #1015.

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Phillip Cloud <417981+cpcloud@users.noreply.github.com>

Author: renovate[bot]

deploy/docker-compose.caddy.yml

@@ -3,7 +3,7 @@
 
 services:
   caddy:
-    image: caddy@sha256:25cdc846626b62d05f6b633b9b40c2c9f6ef89b515dc76133cefd920f7dbe562 # 2-alpine
+    image: caddy@sha256:af5fdcd76f2db5e4e974ee92f96ee8c0fc3edb55bd4ba5032547cbf3f65e486d # 2-alpine
     environment:
       DOMAIN: ${DOMAIN}
     ports:

deploy/docker-compose.yml

@@ -3,7 +3,7 @@
 
 services:
   postgres:
-    image: postgres@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4 # 17-alpine
+    image: postgres@sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20 # 17-alpine
     environment:
       POSTGRES_USER: micasa
       POSTGRES_DB: micasa

deploy/relay/Dockerfile

@@ -2,7 +2,7 @@
 # Licensed under the Apache License, Version 2.0
 
 # golang 1.26-alpine
-FROM golang@sha256:b54cbf583d390341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716 AS build
+FROM golang@sha256:32c0e6e5c4f6707717051091b4d0b077464a679eaab563e11474efc5328e2aa5 AS build
 ARG BUILD_TAGS
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -11,7 +11,7 @@ COPY . .
 RUN CGO_ENABLED=0 go build -trimpath ${BUILD_TAGS:+-tags "$BUILD_TAGS"} -o /relay ./cmd/relay
 
 # distroless static-debian12
-FROM gcr.io/distroless/static-debian12@sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838
+FROM gcr.io/distroless/static-debian12@sha256:9c346e4be81b5ca7ff31a0d89eaeade58b0f95cfd3baed1f36083ddb47ca3160
 COPY --from=build /relay /relay
 EXPOSE 8080
 ENTRYPOINT ["/relay"]