🌱 bump docker to ghcr v2.4.1

[spencerschrock]

This includes both the version bump, and uses the new GHCR image.

Initially sent as a draft PR, as there are a few steps left in the process:

• scorecard upgrade?
• release notes
• promote webapp staging to prod
• ?

Fixes #1473
Fixes #1499

[spencerschrock]

Hoping to get #1509 in here before releasing next week.

[justaugustus]

Sounds good!!

[spencerschrock]

Kicked off a manual e2e test:
https://github.com/ossf-tests/scorecard-action/actions/runs/13446046312

It should run on schedule in ~ 4 hours as well.

Testing the new file mode worked for a test repo with things ignored in .gitattributes:
https://github.com/spencerschrock/actions-test/blob/52aa73dfb0179631f2208da4064bf19280686765/.github/workflows/scorecard.yml#L38-L43
https://github.com/spencerschrock/actions-test/blob/52aa73dfb0179631f2208da4064bf19280686765/.gitattributes

https://github.com/spencerschrock/actions-test/actions/runs/13445540514/job/37570684369#step:4:207

{
  "date": "2025-02-20T22:21:48Z",
  "repo": {
    "name": "github.com/spencerschrock/actions-test",
    "commit": "52aa73dfb0179631f2208da4064bf19280686765"
  },
  "scorecard": {
    "version": "v5.1.1",
    "commit": "cd152cb6742c5b8f2f3d2b5193b41d9c50905198"
  },
  "score": 5.4,
  "checks": [
    {
      "score": 0,
      "reason": "detected GitHub workflow tokens with excessive permissions",
      "name": "Token-Permissions",
    },
    {
      "details": null,
      "score": 10,
      "reason": "no dangerous workflow patterns detected",
      "name": "Dangerous-Workflow",
    },
  // ...

[justaugustus]

Thanks @spencerschrock !