fix: pin Docker image to versioned tag 3.2.0 (#10)

* fix: pin Docker image to versioned tag 3.2.0

Replaces mutable :latest tag with immutable :3.2.0 for reproducible
builds and supply-chain security. The 3.2.0 image includes Verification
Context v1.0 output support.

* fix: use sha256 digest for immutable image pin, update docs

- action.yml: use sha256 digest instead of mutable :3.2.0 tag
- CONTRIBUTING.md: reference 3.2.0 instead of latest
- SECURITY.md: reference 3.2.0 instead of latest

Author: rahuldass19

CONTRIBUTING.md

@@ -23,7 +23,7 @@ Test locally with Docker (the same image the action runs):
 ```bash
 docker run --rm -e INPUT_ACTION=scan-secrets -e INPUT_PATHS="**/*.env" \
   -v "$PWD:/github/workspace" -w /github/workspace \
-  qwedai/qwed-verification:latest
+  qwedai/qwed-verification:3.2.0
 ```
 
 ## Release Process

SECURITY.md

@@ -22,7 +22,7 @@ Please include:
 
 ## Scope
 
-This action is a thin wrapper over the QWED core image (`docker://qwedai/qwed-verification:latest`). Vulnerabilities in the underlying engines and guards belong to the core repository:
+This action is a thin wrapper over the QWED core image (`docker://qwedai/qwed-verification:3.2.0`). Vulnerabilities in the underlying engines and guards belong to the core repository:
 
 https://github.com/QWED-AI/qwed-verification/security
 

action.yml

@@ -87,7 +87,7 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'docker://qwedai/qwed-verification:latest'
+  image: 'docker://qwedai/qwed-verification@sha256:be5d26f1ddfb5cba809bad51c629d4c4ed4f4ef0aa2a9b8bd78063ec2e0afdab'
   env:
     INPUT_API_KEY: ${{ inputs.api_key }}
     INPUT_API_URL: ${{ inputs.api_url }}