Pin exact versions of images and actions

Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7)
change under a deploy without anyone deciding it: the storage deploy
moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin
every image and action to its exact current version, so each change
arrives as a reviewed Renovate PR and a rollback is a revert.

Assisted-by: Claude:opus-5-5

ansible/roles/forgejo_runner/templates/config.yaml.j2

@@ -14,20 +14,20 @@ runner:
   fetch_interval: 2s
   report_interval: 1s
   labels:
-    - "ubuntu-latest:docker://node:20-bookworm"
-    - "ubuntu-22.04:docker://node:20-bookworm"
-    - "ubuntu-24.04:docker://node:22-bookworm"
-    - "debian-latest:docker://debian:bookworm"
-    - "debian-12:docker://debian:bookworm"
-    - "debian-11:docker://debian:bullseye"
-    - "arch-latest:docker://archlinux:latest"
-    - "nginx-latest:docker://nginx:latest"
-    - "nginx-alpine:docker://nginx:alpine"
-    - "node-20:docker://node:20"
-    - "node-22:docker://node:22"
-    - "python-3.11:docker://python:3.11"
-    - "python-3.12:docker://python:3.12"
-    - "alpine-latest:docker://alpine:latest"
+    - "ubuntu-latest:docker://node:20.20.2-bookworm"
+    - "ubuntu-22.04:docker://node:20.20.2-bookworm"
+    - "ubuntu-24.04:docker://node:22.23.5-bookworm"
+    - "debian-latest:docker://debian:12.15"
+    - "debian-12:docker://debian:12.15"
+    - "debian-11:docker://debian:11.11"
+    - "arch-latest:docker://archlinux:base-20261108.0.623074"
+    - "nginx-latest:docker://nginx:1.31.8"
+    - "nginx-alpine:docker://nginx:1.31.8-alpine"
+    - "node-20:docker://node:20.20.2"
+    - "node-22:docker://node:22.23.5"
+    - "python-3.11:docker://python:3.11.18"
+    - "python-3.12:docker://python:3.12.16"
+    - "alpine-latest:docker://alpine:3.24.4"
     - "nix-latest:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
 
 cache: