[Task]: Use build sha for base images in docker file + dependabot to update them.

[KevinMind]

Description

We can avoid fetching build manifest for upstream images in our set up by pinning the versions to a specific build sha. If that image is on your local registry docker will just use it. This better enables offline development by removing the need to ping dockerhub regularly.

We can use dependabot to keep these images up to date and proactively maintain our base systems.

Example:

version: 2
updates:
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "daily"

Acceptance Criteria

Milestones/checkpoints

Preview Give feedback

1. pin our base dependency docker images in Dockerfile and docker-compose.yml to a build sha
2. add docker and docker-hub registry to dependabot on weekly rotation

Checks

• If I have identified that the work is specific to a repository, I have removed "repository:addons-server" or "repository:addons-frontend"

┆Issue is synchronized with this Jira Task

[KevinMind]

Docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference?learn=dependency_version_updates&learnProduct=code-security

[KevinMind]

Should also include mozilla/addons-server#23193 (comment)