refactor(web): stop upgrading base packages during build

[vitormattos]

Closes #68.
Part of #47.

The web image should inherit its package set from the selected nginx:alpine base instead of mutating that base with a blanket apk upgrade --no-cache during every build.

This PR removes the blanket upgrade.

Base-image updates remain explicit and reviewable through Dependabot, and the existing image build/Trivy workflow continues to detect vulnerable packages.

This keeps the image reproducible from its declared base and avoids silently changing all Alpine packages when the Dockerfile itself has not changed.

[vitormattos]

The CI failure shows that this change is not safe to merge as-is.

Without apk upgrade --no-cache, the current nginx:alpine base resolves to Alpine 3.24.2 containing two HIGH vulnerabilities that already have fixed packages available:

• libexpat: CVE-2026-93990, installed 2.8.4-r0, fixed in 2.8.5-r0;
• pcre2: CVE-2026-103111, installed 10.48-r0, fixed in 10.49-r0.

The Trivy gate is therefore behaving correctly.

Also, nginx:alpine is itself a moving tag, so simply removing the package upgrade does not make the build reproducible. True reproducibility would require pinning the base image by digest and maintaining that digest through dependency automation.

Closing this PR rather than weakening the vulnerability policy or adding CVE exceptions. A future base-image reproducibility change should first pin/update the base image and prove that the resulting image passes Trivy without a blanket package upgrade.