rss-bridge: qualify the image registry, except the port-80 finding

Two findings from the Trivy config scan that landed on main in #129.

AVD-KSV-0125 is fixed rather than excepted: writing the image as
docker.io/rssbridge/rss-bridge puts a real registry in the registry
position instead of "rssbridge", which is what ci/trivy/data/ksv0125.yaml
asks for. Verified in k3d that the qualified reference resolves to the
same digest (sha256:0eca99b2...) and still runs.

AVD-KSV-0117 (containerPort below 1024) becomes a scoped, documented
exception. nginx listens on 80 inside the image, and the entrypoint's
only way to change that is a sed against /etc/nginx/sites-enabled/default
which a read-only root filesystem rejects - so the alternative to port 80
is giving up readOnlyRootFilesystem. The premise of the check does not
hold here anyway: the container binds 80 as uid 33 with all capabilities
dropped and no NET_BIND_SERVICE.

trivy config now reports 0 to act on for this chart.

ci/trivy/trivyignore.yaml

@@ -108,3 +108,8 @@ misconfigurations:
   - id: AVD-KSV-0119
     paths: ["**/homeassistant.yaml"]
     statement: "NET_RAW is the capability in question and is added on purpose for device discovery; see AVD-KSV-0022."
+
+  # --- rss-bridge: port 80 is fixed by the image ----------------------------
+  - id: AVD-KSV-0117
+    paths: ["**/rss-bridge.yaml"]
+    statement: "nginx inside the image listens on 80, and the only way the entrypoint offers to change it (HTTP_PORT) is a sed against /etc/nginx/sites-enabled/default, which a read-only root filesystem rejects - so the alternative to port 80 would be giving up readOnlyRootFilesystem. The premise of the check does not apply here either: the container binds 80 as uid 33 with ALL capabilities dropped and no NET_BIND_SERVICE, verified in k3d. Renaming is also not free - the Service selects the port by name (rss-bridge-port), which is what keeps the takeover of the existing installation a no-op."

rss-bridge/templates/rss-bridge.deployment.yaml

@@ -27,7 +27,11 @@ spec:
         {{- include "rss-bridge.podSecurityContext" .Values.rssBridge.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
-          image: "rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
+          # Registry written out in full on purpose: an unqualified Docker Hub
+          # reference puts "rssbridge" in the registry position, which says
+          # nothing about where the image comes from and is reported as an
+          # untrusted registry (AVD-KSV-0125). See ci/trivy/data/ksv0125.yaml.
+          image: "docker.io/rssbridge/rss-bridge:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           env:
             {{- range $value := .Values.rssBridge.env }}