Merge branch 'next' into release/0.6.0-rc0

Brings in the three fixes found while testing this release candidate:
KMS CA certificates (#1128), ACME authorization parsing (#1129), and the
DNS-01 self check against authoritative nameservers (#1130).

Author: kvinwang

.github/workflows/docker-build-check.yml

@@ -88,6 +88,11 @@ jobs:
             DSTACK_REV=${{ env.DSTACK_REV }}
             DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}
 
+      - name: Verify pinned packages
+        run: |
+          dstack/build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
+            dstack/kms/dstack-app/builder/shared/pinned-packages.txt
+
       - name: Build kms-builder target
         run: |
           docker buildx build \

REUSE.toml

@@ -48,6 +48,7 @@ path = [
     "sdk/go/go.sum",
     "sdk/go/ratls/go.sum",
     "dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt",
+    "dstack/kms/dstack-app/builder/shared/pinned-packages.txt",
     "dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt",
     "dstack/gateway/dstack-app/builder/shared/pinned-packages.txt",
 ]