ci: enable dependabot docker base image updates

[rbtr]

Use tag-qualified digest references in Dockerfiles so Dependabot can detect and update base images. Configure grouped Docker updates for Go toolchain and base OS images.

Reason for Change:

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Pull request overview

This PR updates Docker base image references to use tag-qualified digest pins (image:tag@sha256:...) so Dependabot can reliably detect and update them, and attempts to configure Dependabot to scan the relevant Dockerfile directories and group related image bumps.

Changes:

• Convert multiple Dockerfiles (and their templates/rendered variants) to tag@digest base image references.
• Remove Makefile logic that dynamically computes pinned image digests via skopeo (now pins are checked in).
• Update Dependabot configuration to (intended) scan multiple Dockerfile directories and group Go toolchain vs base OS updates.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
npm/windows.Dockerfile	Pin Go builder and Windows base image using tag@digest.
npm/linux.Dockerfile	Pin Go builder and Ubuntu base image using tag@digest.
cns/Dockerfile.tmpl	Hardcode tag@digest base image references in template for Dependabot visibility.
cns/Dockerfile	Update rendered CNS Dockerfile to tag@digest references.
cni/Dockerfile.tmpl	Hardcode tag@digest base image references in template for Dependabot visibility.
cni/Dockerfile	Update rendered CNI Dockerfile to tag@digest references.
cilium-log-collector/Dockerfile.tmpl	Pin Go builder and fluent-bit base image using tag@digest in template.
cilium-log-collector/Dockerfile	Update rendered Dockerfile to tag@digest references.
build/images.mk	Remove exported image variables and skopeo inspect-based pin generation; keep render targets.
bpf-prog/ipv6-hp-bpf/linux.Dockerfile	Pin Go builder and Azure Linux distroless base image using tag@digest.
azure-iptables-monitor/Dockerfile.tmpl	Pin Azure Linux core/distroless and Go builder using tag@digest in template.
azure-iptables-monitor/Dockerfile	Update rendered Dockerfile to tag@digest references.
azure-ipam/Dockerfile.tmpl	Pin Go builder, Azure Linux core, and Windows HPC base image using tag@digest in template.
azure-ipam/Dockerfile	Update rendered Dockerfile to tag@digest references.
azure-ip-masq-merger/Dockerfile.tmpl	Pin Go builder using tag@digest in template.
azure-ip-masq-merger/Dockerfile	Update rendered Dockerfile to tag@digest references.
.pipelines/build/dockerfiles/npm.Dockerfile	Pin Windows servercore and Ubuntu base images using tag@digest for pipeline artifact images.
.pipelines/build/dockerfiles/ipv6-hp-bpf.Dockerfile	Pin Azure Linux distroless base image using tag@digest for pipeline artifact image.
.pipelines/build/dockerfiles/cns.Dockerfile.tmpl	Pin Windows HPC and Azure Linux base images using tag@digest in pipeline template.
.pipelines/build/dockerfiles/cns.Dockerfile	Update rendered pipeline Dockerfile to tag@digest references.
.pipelines/build/dockerfiles/cni.Dockerfile.tmpl	Pin Windows HPC base image using tag@digest in pipeline template.
.pipelines/build/dockerfiles/cni.Dockerfile	Update rendered pipeline Dockerfile to tag@digest references.
.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl	Pin fluent-bit base image using tag@digest in pipeline template.
.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile	Update rendered pipeline Dockerfile to tag@digest references.
.pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile.tmpl	Pin Azure Linux core/distroless base images using tag@digest in pipeline template.
.pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile	Update rendered pipeline Dockerfile to tag@digest references.
.pipelines/build/dockerfiles/azure-ipam.Dockerfile.tmpl	Pin Windows HPC base image using tag@digest in pipeline template.
.pipelines/build/dockerfiles/azure-ipam.Dockerfile	Update rendered pipeline Dockerfile to tag@digest references.
.github/dependabot.yaml	Attempt to configure Dependabot docker updates across multiple directories and group related image updates.

[rbtr]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).