chore(ci): Publish container images via CI/CD

[hairmare]

Publish container images to ghcr.io based on rabe actions.

After merge this will:

• publish each change to the main branch as ghcr.io/radiorabe/website-stack/next:latest
• publish tags as ghcr.io/radiorabe/website-stack/next:<tag>
• run a daily container image security scan on the latest image and upload the results to the GitHub security tab

This reflects our container image build best-practices. In this type of image build, we recommend using a pull-request based approach with conventional commits and semantic-release to ensure that every change is automatically tagged and released, I'll followup on this in #13.

• Fixes Publish container nextjs images to ghcr.io/radiorabe #11

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[AareFabrik]

Hi @hairmare
Thanks for the PR, I will look into that. Looks promising

[hairmare]

@AareFabrik the docker docs currently mention 1. April as the target date for these rate limits:

• Unauthenticated users: 10 pulls/hour
• Authenticated users with a free account: 100 pulls/hour

I don't think we need to panic considering our current usage pattern, but merging this would certainly be a step towards having some more security.

[hairmare]

question (non-blocking): this value might need updating to whatever is currently on prod, it's current value seems to be in the .env file