Define vulnerability and release policy for third-party nginx and MariaDB images

[tbelz]

Context

The owned-image baseline in #75 covers NITA's Ansible, Jenkins, Robot, Webapp,
and Junos MCP images. NITA also deploys third-party nginx proxy and MariaDB
runtime images whose findings, ownership, and update policy must be handled
explicitly rather than represented as covered by the owned-image gate.

Webapp issue Juniper/nita-webapp#53 discusses an ingress-nginx controller.
NITA's current manifests use ordinary nginx proxy containers, so that issue is
related context but not a direct inventory of the runtime images deployed here.

Scope

• Inventory every nginx and MariaDB image reference used by NITA manifests,
  examples, and tests.
• Decide whether references use supported fixed versions or immutable digests
  while retaining verified amd64/arm64 support.
• Assign ownership for updates, compatibility testing, release notes, and
  vulnerability review.
• Define scan timing, artifact retention, severity policy, and any exception
  format for third-party images.
• Validate database migrations, proxy/TLS behavior, and architecture coverage
  for every update.
• Document the boundary between this policy, Webapp Add section for xls-to-yaml tools in install.sh #53, and NITA-owned image
  publishing.

Acceptance criteria

• The complete deployed third-party image inventory is documented.
• Every image has an update owner and supported-version/digest rule.
• Both linux/amd64 and linux/arm64 availability are verified before
  adoption.
• HIGH/CRITICAL findings are visible and the blocking/exception policy is
  explicit.
• Compatibility and rollback checks cover MariaDB state and nginx
  proxy/TLS behavior.
• Replace nginx nita-webapp#53 is referenced without conflating ingress-nginx
  with NITA's ordinary nginx proxy containers.

Related: #75, #29, #51, Juniper/nita-webapp#53.