rss-bridge: qualify the image registry, except the port-80 finding

Two findings from the Trivy config scan that landed on main in #129.

AVD-KSV-0125 is fixed rather than excepted: writing the image as
docker.io/rssbridge/rss-bridge puts a real registry in the registry
position instead of "rssbridge", which is what ci/trivy/data/ksv0125.yaml
asks for. Verified in k3d that the qualified reference resolves to the
same digest (sha256:0eca99b2...) and still runs.

AVD-KSV-0117 (containerPort below 1024) becomes a scoped, documented
exception. nginx listens on 80 inside the image, and the entrypoint's
only way to change that is a sed against /etc/nginx/sites-enabled/default
which a read-only root filesystem rejects - so the alternative to port 80
is giving up readOnlyRootFilesystem. The premise of the check does not
hold here anyway: the container binds 80 as uid 33 with all capabilities
dropped and no NET_BIND_SERVICE.

trivy config now reports 0 to act on for this chart.

rss-bridge/templates/rss-bridge.deployment.yaml

@@ -27,7 +27,11 @@ spec:
         {{- include "rss-bridge.podSecurityContext" .Values.rssBridge.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
-          image: "rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
+          # Registry written out in full on purpose: an unqualified Docker Hub
+          # reference puts "rssbridge" in the registry position, which says
+          # nothing about where the image comes from and is reported as an
+          # untrusted registry (AVD-KSV-0125). See ci/trivy/data/ksv0125.yaml.
+          image: "docker.io/rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           env:
             {{- range $value := .Values.rssBridge.env }}