Update packages to fix CVEs in RHEL STIG images

[almaslennikov]

CVE-2025-15467, CVE-2025-66418, CVE-2026-21441: python3-urllib3 -> 1.26.5-6.el9_7.1
CVE-2025-66471, CVE-2025-69421: openssl, openssl-libs -> 1:3.5.1-7.el9_7

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds a flexible mechanism to update specific packages in RHEL STIG images to address CVE vulnerabilities. The implementation adds a CVE_UPDATES_RHEL variable in the GitLab CI configuration that lists packages to update (openssl python3-urllib3), passes this as a build argument to both operator and daemon RHEL Dockerfiles, and performs conditional package updates using dnf update.

Key Changes:

• Centralized CVE package list in .gitlab-ci.yml for easy maintenance
• Conditional update step only runs when CVE_UPDATES_RHEL is non-empty
• Applied consistently to both operator and daemon RHEL STIG images
• Proper cleanup with dnf clean all to minimize image size

Note: The CVE numbers in the PR description appear to have formatting issues - CVE-2025-66418, CVE-2026-21441, CVE-2025-66471, and CVE-2025-69421 use unusually high CVE-ID numbers and one references 2026. Verify these CVE identifiers are correct.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation is clean, follows Docker best practices with conditional execution and cleanup, and maintains consistency across both RHEL STIG Dockerfiles. The changes are additive and don't modify existing functionality. Package updates are a standard security practice for addressing CVEs.
• No files require special attention

Important Files Changed

Filename	Overview
.gitlab-ci.yml	Added CVE_UPDATES_RHEL variable and passed it as build arg to RHEL STIG image builds
Dockerfile.daemon.stig-rhel	Added conditional dnf update step for CVE packages specified via build arg
Dockerfile.operator.stig-rhel	Added conditional dnf update step for CVE packages specified via build arg

_{Last reviewed commit: 2ecd363}

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}