fix: apply review feedback on Docker storage and security documentation

- Fix storage_ip derivation to use default route first, not Swarm RemoteManagers
- Make iSCSI container entrypoint idempotent (check before create for target/LUN/bind)
- Pin erichough/nfs-server from 'latest' to '2.2.1' for reproducibility
- Replace curl|sh Docker install with apt repo in Dockerfile.test
- Add docker.sock security warnings in docker-compose.test.yml and CI workflow
- Update stale 'storage VM' references in comments and .env.test.example"

Co-authored-by: GoodOlClint <151449+GoodOlClint@users.noreply.github.com>
Agent-Logs-Url: https://github.com/GoodOlClint/PSProxmoxVE/sessions/534c0a63-2988-496c-b0ae-e291fcfa050b

.github/workflows/integration-tests.yml

@@ -115,6 +115,10 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
       volumes:
         - /opt/pve-isos:/opt/pve-isos
+        # WARNING: The Docker socket is mounted to allow storage containers to be
+        # managed from within the job container. This grants root-equivalent access
+        # to the runner's Docker daemon. Only use on dedicated, isolated self-hosted
+        # runners — never on shared runners.
         - /var/run/docker.sock:/var/run/docker.sock
 
     steps:
@@ -186,6 +190,10 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
       volumes:
         - /opt/pve-isos:/opt/pve-isos
+        # WARNING: The Docker socket is mounted to allow storage containers to be
+        # stopped from within the job container. This grants root-equivalent access
+        # to the runner's Docker daemon. Only use on dedicated, isolated self-hosted
+        # runners — never on shared runners.
         - /var/run/docker.sock:/var/run/docker.sock
 
     steps: