[YvesCesar]

Summary

The PHP images run two installers downloaded at build time without any verification: install-php-extensions from the latest release and the nvm installer from the master branch, piped into bash. The nginx image was built from the floating nginx:alpine tag and is republished every night. A change upstream would end up in the published :latest images without any review in this repository.

This change:

• Downloads install-php-extensions 2.13.2 and the nvm v0.41.0 installer with ADD --checksum, so the build fails if the content differs from the pinned SHA-256. The nvm installer is no longer piped into a shell.
• Pins the nginx base image to nginx:1.31.8-alpine by digest, which Dependabot already tracks under /.docker/.
• Adds a policy test that rejects floating references for these downloads.

Validation

• New test in tests/proxy/compose-policy.bats fails on main and passes with this change; the rest of the file still passes.
• Built Dockerfile.php83 and Dockerfile.nginx locally: the PHP image installs the same 59 PHP modules and Node 24 with npm and nvm 0.41.0, and the installers are not left in the image.
• A build with a wrong checksum fails with a digest mismatch.