UID2-7335: upgrade libexpat to patch CVE-2026-45186

Adds the Alpine libexpat package to the apk --no-cache --upgrade step so
libexpat is bumped to 2.8.1-r0 at build time, clearing the HIGH-severity
DoS-via-crafted-XML finding (CVE-2026-45186). Bumping the pinned base
image SHA is insufficient: the latest 21-jre-alpine-3.23 image still
ships libexpat 2.7.x. (Note: the vulnerable package is libexpat, a
separate subpackage from the standalone 'expat' CLI package.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: swibi-ttd

Dockerfile

@@ -17,7 +17,7 @@ COPY ./conf/default-config.json /app/conf/
 COPY ./conf/*.xml /app/conf/
 COPY ./webroot/ /app/webroot/
 
-RUN apk add --no-cache --upgrade libpng libcrypto3 libssl3 musl musl-utils gnutls && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads
+RUN apk add --no-cache --upgrade libpng libcrypto3 libssl3 musl musl-utils gnutls libexpat && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads
 USER uid2-admin
 
 CMD java \