chore: update reusable docker pipeline to v0.16.0

[mpastecki]

Summary

Updates reusable_docker_pipeline.yml to v0.16.0 (a5bf0dd).

This version introduces pre-push security scanning — images are scanned
for vulnerabilities and secrets before being pushed to registries.

What changes in v0.16.0

• Scan-before-push: Trivy filesystem + image scans run before any registry push
• Secret scanning: source code and image layer secret detection
• Scans enabled by default: docker_scan: true, trivy_nofail: false, hadolint_nofail: false
• DockerHub push disabled by default: push_to_dockerhub now defaults to false
• Job Summary: scan results appear directly in the GitHub Actions run summary
• SARIF upload: vulnerability findings surface in GitHub Security tab (public repos)
• Build caching: scan build layers are reused via cache-from for push steps

[Copilot]

Pull request overview

This PR updates the reusable Docker pipeline workflow from v0.11.2 to v0.16.0 in the publish workflow. The new version introduces pre-push security scanning with Trivy, including vulnerability detection and secret scanning, with results surfaced in GitHub Actions summaries and the Security tab via SARIF uploads.

Changes:

• Updated reusable_docker_pipeline.yml reference to v0.16.0 (commit a5bf0dd)
• Removed trailing whitespace on lines 11 and 20

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The v0.16.0 update introduces SARIF upload functionality that uploads vulnerability findings to GitHub Security tab. This requires the security-events: write permission to be added to the permissions block. Without this permission, the SARIF upload step will fail for public repositories.

Add the following to the permissions section:

permissions:
  contents: read
  security-events: write

Suggested change

	contents: read
	contents: read
	security-events: write

[mpastecki]

It seems to be partially true, but the permission might be needed in the reusable workflow, not here. I will check.