fix: Implement dependency digest tracking for nightly builds

- Updated Docker Compose files to use digest-pinned images for CI contexts.
- Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums.
- Added Renovate configuration for tracking Go tool versions and digest updates.
- Introduced a new design document outlining the architecture and data flow for dependency tracking.
- Created tasks and requirements documentation to ensure compliance with the new digest pinning policy.
- Updated security documentation to reflect the new digest pinning policy and exceptions.

.docker/compose/docker-compose.yml

@@ -1,6 +1,8 @@
 services:
   charon:
-    image: ghcr.io/wikid82/charon:latest
+    # Override for local testing:
+    # CHARON_IMAGE=ghcr.io/wikid82/charon:latest
+    image: ${CHARON_IMAGE:-ghcr.io/wikid82/charon:latest@sha256:371a3fdabc7f52da65a4ac888531a413b6a56294f65041a42fdc0c407e8454c4}
     container_name: charon
     restart: unless-stopped
     ports: