Issue/434 Automate Builds

[hhund]

Improved Actions workflow and dependabot config:

• Added a dependabot config to automate creation of pull requests for maven, github-actions, docker and docker-compose version upgrades. Will be active once merged into main.
• Fixed missing tika-core version in maven api v2 dependency copy config.
• Pinned base docker images in Dockerfiles.
• Reconfigured GitHub Actions workflows: New build.yml workflow with automated maven and docker builds. Maven build configured to run tests and other elements in parallel. Docker images are scanned with trivy, trivy results are published to the internal GitHub Security Code Scanning results page. Docker images are signed and can be verified using cosign verify ghcr.io/datasharingframework/<image>:<tag>@sha256:<digest> --certificate-identity-regexp "https://github.com/datasharingframework/dsf/.*" --certificate-oidc-issuer "https://token.actions.githubusercontent.com". A cyclonedx SBOM is generated for the docker images and attached to the registry, SBOM is signed by cosign. New workflow includes codeql config.
• New build.yml workflow is configured to run for pushes in release/* and hotfix/* branches, on Git tag pushes (regular releases, milestone and release candidates), on pull request to main and develop (opened, synchronize, reopened and closed events) as well as on a weakly schedule.
• Releases are triggered via Git tags: If a commit is tagged that is part of the main branch, the docker images are tagged with a.b, a.b.c and 'latest'. Other Git tags (e.g. in a hotfix branch) will result in a.b and a.b.c for regular releases, and (e.g. in a release branch) a.b.c-RCx or a.b.c-Mx for preview releases. Merged pull requests into the develop branch trigger a docker image build that is tagged with 'develop'.

closes #434

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[hhund]

The Node.js 20 deprecation warning in https://github.com/datasharingframework/dsf/actions/runs/23116834123 is related to aquasecurity/trivy-action using actions/cache v4, see aquasecurity/trivy-action#528