build: docker-bake migration

[ziscky]

Migrate from Earthly to Docker Bake build system. Adds Dockerfile, docker-bake.hcl, helper script, CI workflow, and .dockerignore.

To fix the problem, explicitly declare a permissions block that grants only the minimal required scopes to GITHUB_TOKEN. For a publish-to-registry workflow that doesn’t obviously need to write to the repository (no checkouts, tagging, or releases in the shown snippet), a conservative starting point is repository contents read-only plus packages write (so the token can push images if needed). This should be declared at the workflow root so it applies to the reused job unless that job overrides it.

Concretely, in .github/workflows/publish-docker-bake.yml, insert a root-level permissions section between the on: block and the jobs: block (around line 17). Use:

permissions:
  contents: read
  packages: write

This keeps repository contents read-only while allowing package publishing (e.g., to GitHub Container Registry). If the reusable workflow later proves to need more/less, this block can be adjusted, but this is a safe, least-privilege default that resolves the CodeQL finding without changing any functional behavior for Docker Hub publishing (which uses explicit secrets, not GITHUB_TOKEN).