[#1238] Leave out of the Docker images what only AWT needs: the headless JRE on alpine, no fontconfig, freetype or brotli on the default image (#1239)

Fixes #1238

### Problem

Code scanning alert 1341 (CVE-2026-111497, `brotli-libs` 1.2.0-r1) was
raised against the published `alpine` image. Nothing in OpenDJ uses
Brotli. The package comes in through `openjdk25-jre` → `freetype` →
`brotli-libs`: the full JRE needs freetype for AWT. The server and the
command-line tools never draw, but the full JRE adds 19 packages that
only AWT needs (X11, ALSA, freetype, brotli, libpng, libjpeg-turbo,
giflib, lcms2, …), and a CVE in any of them raises an alert on the
image.

The default image (`eclipse-temurin:25-jre-noble`) has no X11 or ALSA.
Its JRE renders fonts with a freetype of its own that links only libc.
The base image still adds `fontconfig` with the freetype of the OS,
`libbrotli1` 1.1.0 (inside the range the CVE affects) and the DejaVu
fonts. `apt-get remove --purge curl unzip` also left `libcurl4t64`
behind, together with its Kerberos, LDAP and SASL libraries.

### Change

- **`Dockerfile-alpine`**: `openjdk25-jre-headless` instead of
`openjdk25-jre`, and `openjdk11-jre-headless` instead of `openjdk11-jre`
on linux/386.
- **`Dockerfile`**: `apt-get purge -y --auto-remove curl unzip
fontconfig libfreetype6` instead of `apt-get remove -y --purge curl
unzip`.
- **`build.yml`**: the `Docker test` step first checks that the image
has no freetype outside `/opt/java`, no brotli, no X11 and no ALSA
libraries. The check runs in both rows (default and alpine).

`control-panel` keeps working from outside the container, against its
administration port.

### Testing

I built both images locally, from master and from this branch, with the
5.2.0 release zip (`--build-arg VERSION=5.2.0`). The code of master is
5.2.0 plus CI changes.

| | alpine (amd64) | default |
|---|---|---|
| packages, master → branch | 55 → 36 | 121 → 99 |
| size, master → branch | 357 → 346 MB | 407 → 403 MB |
| new check on master | fails: `libfreetype`, `libbrotli*`, `libX11`,
`libasound` | fails: `libfreetype`, `libbrotli*` |
| new check on the branch | passes | passes |

- Removed from alpine: `alsa-lib brotli-libs freetype giflib lcms2
libbsd libbz2 libjpeg-turbo libmd libpng libx11 libxau libxcb libxdmcp
libxext libxi libxrender libxtst openjdk25-jre`.
- Removed from default: `fontconfig fontconfig-config fonts-dejavu-core
fonts-dejavu-mono libbrotli1 libcurl4t64 libexpat1 libfontconfig1
libfreetype6 libgssapi-krb5-2 libk5crypto3 libkeyutils1 libkrb5-3
libkrb5support0 libldap2 libnghttp2-14 libpng16-16t64 libpsl5t64
librtmp1 libsasl2-2 libsasl2-modules-db libssh-4`.
- Neither image gained a package.
- `java`, `keytool`, `ldapsearch` and `dsconfig` run in alpine amd64
(JDK 25.0.4), alpine linux/386 (JDK 11.0.32) and default (Temurin
25.0.4.1).

I also ran the `Docker test*` steps of `build.yml` against the branch
images:

- **alpine**: `Docker test`, custom password, base DN with a space,
arbitrary uid, secret volume, bootstrap LDIFs, health check and failed
bootstrap pass. `replication` timed out locally while `dj-x` retried its
join through the absent peer. Each join round took about 50 s on Docker
Desktop, so 5 of 10 rounds fit in the 300 s wait. CI runs this step.
- **default**: custom password, base DN with a space, arbitrary uid,
health check and failed bootstrap pass. `Docker test`, secret volume,
bootstrap LDIFs and replication are left to CI.