ci(lts-2.21): update docker actions + trivy to current majors

[guimard]

Updates the remaining outdated actions (the docker/* composite + trivy).

Action	After
docker/setup-qemu-action	v4
docker/setup-buildx-action	v4
docker/login-action	v4
docker/metadata-action	v6
docker/build-push-action	v7
aquasecurity/trivy-action	v0.36.0

Left as-is on purpose: hadolint/hadolint-action (pinned by commit SHA — good
practice) and christian-korneck/update-container-description-action@v1 (already
the current major).

⚠️ Behaviour note — build-push-action@v7: since v5, build attestations
(provenance/SBOM) are added by default when pushing, which appends an extra
attestation entry to the image index on Docker Hub. If you want the previous
behaviour (no attestation manifest), add provenance: false to the
build-push-action steps in .github/actions/docker-common/action.yml. Say the
word and I add it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a960b3fa-9b22-4ece-972f-3031c57ec561

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/bump-docker-actions-lts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}