feat: multi-arch builds, Trivy scanning, update base image to 24.04

[apham0001]

Summary

The guest-image CI has several issues:

Problems found

• Multi-arch builds are broken — docker/setup-qemu-action and docker/setup-buildx-action are set up in push.yml but the platforms: parameter is missing from docker/build-push-action, so only amd64 images are published
• No security scanning — no Trivy, no CodeQL, no SARIF uploads
• Base image approaching EOL — ubuntu:22.04 standard support ends April 2027
• No proper image tagging — only latest tag, no SHA-based tags for pinning
• Actions are outdated — checkout@v3, qemu@v2, buildx@v2, login@v2, build-push@v4
• No GHCR publishing — images only go to Docker Hub and Quay.io
• No SHA pinning — actions referenced by mutable tags, vulnerable to supply chain attacks

Changes

push.yml:

• Add platforms: linux/amd64,linux/arm64 to actually enable multi-arch
• Add docker/metadata-action for proper tagging (latest + sha-<short> + git tags)
• Add GHCR as third registry
• Add GHA build cache for faster builds
• Update all actions to latest versions with SHA pinning
• Add tag trigger for release builds

build.yml:

• Add multi-arch validation (build both platforms on PRs)
• Add Trivy container scanning with SARIF upload to GitHub Security tab
• Update actions to latest versions with SHA pinning

Dockerfile:

• Update base image from ubuntu:22.04 to ubuntu:24.04

Security: SHA-pinned actions

All actions pinned to exact commit SHAs to prevent supply chain attacks via tag manipulation.

Test plan

• Multi-arch build succeeds (amd64 + arm64)
• Trivy scan runs and uploads results to Security tab
• Images are properly tagged (latest + sha)
• containerssh-agent binary works on both architectures