chore(deps): pin dependencies (#17)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| koalaman/shellcheck-alpine |  | pinDigest |  -> `bdcdfa7` |
| [pipelinecomponents/hadolint](https://gitlab.com/pipeline-components/hadolint) |  | pinDigest |  -> `7122937` |
| ubuntu | final | pinDigest |  -> `e9569c2` |
| [woodpeckerci/plugin-docker-buildx](https://codeberg.org/woodpecker-plugins/docker-buildx) ([source](https://codeberg.org/woodpecker-plugins/docker-buildx.git)) |  | pinDigest |  -> `c7ac0b0` |
| [zricethezav/gitleaks](https://github.com/gitleaks/gitleaks) |  | pinDigest |  -> `eadfe25` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNjguMiIsInVwZGF0ZWRJblZlciI6IjM3LjE2OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIn0=-->

Reviewed-on: #17
Co-authored-by: Renovate Bot <renovate@mgrote.net>
Co-committed-by: Renovate Bot <renovate@mgrote.net>

.woodpecker/build.yml

@@ -7,7 +7,7 @@ variables: # https://woodpecker-ci.org/docs/usage/advanced-usage
 
 steps:
   selfhosted_push:
-    image: "woodpeckerci/plugin-docker-buildx:3.0.1"
+    image: "woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01"
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/allzweckcontainer

.woodpecker/lint.yml

@@ -1,7 +1,7 @@
 ---
 steps:
   gitleaks:
-    image: zricethezav/gitleaks:v8.18.2
+    image: zricethezav/gitleaks:v8.18.2@sha256:eadfe256fa18d6a78a717abc9ed454c8e03865d1c46d627bca83977f4424901a
     commands:
       - gitleaks detect --no-git --verbose --source $CI_WORKSPACE
     when:
@@ -10,7 +10,7 @@ steps:
           - tag
 
   hadolint:
-    image: pipelinecomponents/hadolint:0.26.0
+    image: pipelinecomponents/hadolint:0.26.0@sha256:7122937006c7a9bcbb78ce764d3c2f0092f183b843ad128bc9fd6ea918e22d5b
     commands:
       - hadolint Dockerfile
     when:
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: "koalaman/shellcheck-alpine:latest"
+    image: "koalaman/shellcheck-alpine:latest@sha256:bdcdfa772d6f8c1e9582a1e5c1c0ea1e4de8acdfb79aae2b646367e66410ccca"
     commands:
       - |
         find . -type f -not -path './.git/*' -not -path './collections/*' -exec file {} \; | while IFS= read -r line; do

Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:jammy
+FROM ubuntu:jammy@sha256:e9569c25505f33ff72e88b2990887c9dcf230f23259da296eb814fc2b41af999
 
 ENV DEBIAN_FRONTEND=noninteractive