fix: switch to node-lts chainguard image

[jeff-mccoy]

Chainguard stopped publishing versioned images outside of latest last fall and so dependabot never picked up a newer version. Thanks to @eddiezane pointing this out, we were using a very stale image. This switches the upstream image to the equivalent lts version of Node, which will change version in the next couple of months, but matches our current NodeJS compatibility for Pepr.

[jeff-mccoy]

@cmwylie19 we should probably add grype to our CI as it would have caught this too.

[jeff-mccoy]

See the diff from the current image and the udpated lts image below.

old image:

grype cgr.dev/chainguard/node:20@sha256:f30d39c6980f0a50119f2aa269498307a80c2654928d8e23bb25431b9cbbdc4f
 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                  cgr.dev/chainguard/node:20@sha256:f30d39c6980f0a50119f2aa269498307a80c2654928d8e23bb25431b9cbbdc4f
 ✔ Parsed image                                                                                                                                                             sha256:d4470a8d18997cdfadd75aeffcebe437b0528ab5ee1e4ce9345355d2d2a5c91d
 ✔ Cataloged contents                                                                                                                                                              26cc773ef8322c1ea33cc0f8e4f00f0d5b5dc3e7c17a7323e2dda171b1459f8e
   ├── ✔ Packages                        [287 packages]
   ├── ✔ File digests                    [1,901 files]
   ├── ✔ File metadata                   [1,901 locations]
   └── ✔ Executables                     [61 executables]
 ✔ Scanned for vulnerabilities     [84 vulnerability matches]
   ├── by severity: 3 critical, 24 high, 18 medium, 0 low, 0 negligible (39 unknown)
   └── by status:   82 fixed, 2 not-fixed, 0 ignored

new image:

grype cgr.dev/chainguard/node-lts@sha256:cc860c41bc65df04dc0f2baba355fc4305bf52fc50ff19facb48fcfc879e0413

 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                 cgr.dev/chainguard/node-lts@sha256:cc860c41bc65df04dc0f2baba355fc4305bf52fc50ff19facb48fcfc879e0413
 ✔ Parsed image                                                                                                                                                             sha256:1c1db4dd1ef290bb48e3adfaf011a4eb90beb7ee4dc208af39f97a61d8febeb5
 ✔ Cataloged contents                                                                                                                                                              b77f0afdf7427a8759161857273785abd2534856d727901febf10dc7157ea983
   ├── ✔ Packages                        [247 packages]
   ├── ✔ File digests                    [1,679 files]
   ├── ✔ File metadata                   [1,679 locations]
   └── ✔ Executables                     [63 executables]
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found

[cmwylie19]

@cmwylie19 we should probably add grype to our CI as it would have caught this too.

great idea, was considering this a few weeks ago too. Added an issue and we will get this prioritized #717