Apply Ubuntu security updates when building the Docker image (#1191)

Adds `apt-get upgrade` to the Ubuntu `Dockerfile`, as
`Dockerfile-alpine` already does with `apk upgrade`. Same change as
OpenIdentityPlatform/OpenICF#186.

Without it the `latest` image gets Ubuntu security fixes only when
`eclipse-temurin:25-jre-noble` is rebuilt upstream; an image built in
between keeps the old packages. The released
`openidentityplatform/opendj:latest` shows this: Trivy flags `openssl`
and `libssl3t64` `3.0.13-0ubuntu3.11` with CVE-2026-84782 (fixed in
`3.0.13-0ubuntu3.16`), code scanning alerts #1303 and #1304.

Today's base image already has `openssl` `3.0.13-0ubuntu3.16`, so those
two alerts close with any rebuild. It is still behind `noble-security`,
though: `libfreetype6` and `libpng16-16t64` have security updates it
does not carry, and the upgrade picks them up.

`DEBIAN_FRONTEND=noninteractive` keeps package scripts from prompting.
The workflows build without a layer cache, so the upgrade runs on every
build.

Checked locally: the image builds with `--build-arg VERSION=5.1.2`, has
`openssl` `3.0.13-0ubuntu3.16`, `apt list --upgradable` inside it is
empty, and the container turns healthy.