fix(security): pin runtime to .NET 10.0.11 chiseled (#1)

The 10.0.9 ASP.NET chiseled base shipped Microsoft.NETCore.App 10.0.9,
which the release trivy gate flags with six HIGH advisories:
CVE-2026-47302, CVE-2026-50524, CVE-2026-50528, CVE-2026-50651 and
CVE-2026-57108 (fixed in 10.0.10) plus CVE-2026-62901 (fixed in
10.0.11). Move the runtime stage to 10.0.11-noble-chiseled, pinned by
multi-architecture manifest digest as before, so every finding clears in
one step.

The build stage keeps SDK 10.0.301: the published server is framework
dependent, so the shipped runtime comes from the aspnet base alone and
the discarded builder layer is never scanned.

Dockerfile

@@ -21,7 +21,7 @@ RUN dotnet publish src/FinalFactory.Rendezvous.Server/FinalFactory.Rendezvous.Se
     /p:RepositoryCommit="$SOURCE_REVISION_ID" \
     /p:SourceRevisionId="$SOURCE_REVISION_ID"
 
-FROM mcr.microsoft.com/dotnet/aspnet:10.0.9-noble-chiseled@sha256:f820c4fbfb8bb204c3bbe05c69d48cd039cd0e67aa8f13ac1cec168819b90643 AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:10.0.11-noble-chiseled@sha256:0839314d08bb65da369135389a5d8291f75ace587fbb0488f469eb92c62eef68 AS runtime
 
 ENV ASPNETCORE_HTTP_PORTS=8080 \
     DOTNET_EnableDiagnostics=0 \