external-software/github_OpenIdentityPlatform_OpenDJ.git

Apply Ubuntu security updates when building the Docker image (#1191)

Adds `apt-get upgrade` to the Ubuntu `Dockerfile`, as
`Dockerfile-alpine` already does with `apk upgrade`. Same change as
OpenIdentityPlatform/OpenICF#186.

Without it the `latest` image gets Ubuntu security fixes only when
`eclipse-temurin:25-jre-noble` is rebuilt upstream; an image built in
between keeps the old packages. The released
`openidentityplatform/opendj:latest` shows this: Trivy flags `openssl`
and `libssl3t64` `3.0.13-0ubuntu3.11` with CVE-2026-84782 (fixed in
`3.0.13-0ubuntu3.16`), code scanning alerts #1303 and #1304.

Today's base image already has `openssl` `3.0.13-0ubuntu3.16`, so those
two alerts close with any rebuild. It is still behind `noble-security`,
though: `libfreetype6` and `libpng16-16t64` have security updates it
does not carry, and the upgrade picks them up.

`DEBIAN_FRONTEND=noninteractive` keeps package scripts from prompting.
The workflows build without a layer cache, so the upgrade runs on every
build.

Checked locally: the image builds with `--build-arg VERSION=5.1.2`, has
`openssl` `3.0.13-0ubuntu3.16`, `apt list --upgradable` inside it is
empty, and the container turns healthy.

			@@ -57,6 +57,7 @@

			RUN printf 'Acquire::ForceIPv4 "true";\nAcquire::Retries "5";\n' > /etc/apt/apt.conf.d/99-ci-network \
			&& apt-get update \
			&& DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
			&& apt-get install -y --no-install-recommends curl unzip \
			&& if [ -z "$VERSION" ] ; then VERSION="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest \| grep -m1 "\"name\"" \| cut -d\" -f4)"; fi \
			&& if [ ! -f "$OPENDJ_DIST_FILENAME" ]; then echo file exists && curl -L https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/$VERSION/opendj-$VERSION.zip --output $OPENDJ_DIST_FILENAME; fi \