chore(deps): pin dependencies

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25
+FROM golang:1.25@sha256:698183780de28062f4ef46f82a79ec0ae69d2d22f7b160cf69f71ea8d98bf25d
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1

Dockerfile

@@ -1,10 +1,10 @@
-FROM golang:1.25 AS builder
+FROM golang:1.25@sha256:698183780de28062f4ef46f82a79ec0ae69d2d22f7b160cf69f71ea8d98bf25d AS builder
 WORKDIR /workspace
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /lease-controller ./cmd/main.go
 
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:e8a4044e0b4ae4257efa45fc026c0bc30ad320d43bd4c1a7d5271bd241e386d0
 COPY --from=builder /lease-controller /lease-controller
 ENTRYPOINT ["/lease-controller"]

object-lease-console-plugin/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:24-alpine AS builder
+FROM node:24-alpine@sha256:2867d550cf9d8bb50059a0fff528741f11a84d985c732e60e19e8e75c7239c43 AS builder
 WORKDIR /opt/app
 COPY package.json tsconfig.json webpack.config.js ./
 COPY src ./src
@@ -8,7 +8,7 @@ RUN yarn install --frozen-lockfile || yarn install \
  && yarn build
 
 # Runtime stage: serve plugin assets over HTTPS with service certs
-FROM registry.access.redhat.com/ubi9/nginx-120:latest
+FROM registry.access.redhat.com/ubi9/nginx-120:latest@sha256:01cebb3515239cecfe3e3443e5cf040f892429e401d241e844698588ee2a3424
 # Copy build
 COPY --from=builder /opt/app/dist/ /opt/app-root/src/
 COPY run.sh /usr/local/bin/run.sh

object-lease-operator/Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM quay.io/operator-framework/helm-operator:v1.42.0
+FROM quay.io/operator-framework/helm-operator:v1.42.0@sha256:102abedc1eb4ece4187eab36107cb3176e672ff6bf17d64396cd903ce13affa0
 
 ### Required OpenShift Labels
 LABEL name="Object Lease Operator" \