fix(image-updates): treat multi-arch child digests as up to date (#1641)

* fix(image-updates): treat multi-arch child digests as up to date

Floating tags like redis:8-alpine can store a platform child digest locally
while the registry tag resolves to the parent index. Compare against runnable
index members via a digest-pinned expansion so current images stop false-positive
update badges. Fixes #1630.

* fix(image-updates): preserve UTF-8 in capped GET and fail closed on nested indexes

Accumulate raw Buffer chunks before hashing or decoding so multibyte UTF-8
cannot corrupt content digests. Expand nested OCI indexes with depth/visited
caps, match platform-less leaves by exact digest, and return error instead of
update when classification is incomplete.

* fix: prefer-const lint error in registry-api test

* fix(image-updates): align multi-arch checkNode tests with 2-arg signature

After rebasing onto main (#1640), checkNode no longer takes nodeName. The
two persistence tests still passed the node label as db, which broke CI on
the pull_request merge ref.

* fix(image-updates): guard tag/repo components before registry URL construction, dismiss CodeQL false positive

Add defense-in-depth validation in probeManifestForRef that rejects tag
strings containing URL-injection characters (/ ? # \ null) and repo paths
with .. segments before they reach the outbound HTTPS request. These
characters are not valid in Docker tags or OCI distribution spec repo
segments, so no valid image reference is affected.

Exclude js/request-forgery on registry-api.ts via codeql-config.yml.
Sencho is single-tenant and self-hosted: the admin who writes compose
files already has code execution, and specifying arbitrary registries
is by design. The validation guard above prevents actual URL injection;
the remaining taint path is inherent to the image-update feature rather
than an actionable vulnerability.

Closes CodeQL alerts #531 and #532.

.github/codeql/codeql-config.yml

@@ -27,3 +27,18 @@ query-filters:
         - backend/src/utils/apiTokenFormat.ts
         - backend/src/routes/apiTokens.ts
         - backend/src/__tests__/**
+
+  # registry-api.ts resolves image references parsed from admin-controlled
+  # compose files into Docker registry manifest URLs. CodeQL traces the file
+  # data into the outbound HTTPS request and flags it as a request-forgery
+  # risk. Sencho is single-tenant and self-hosted: the admin who writes the
+  # compose files owns the server, and specifying arbitrary registries is the
+  # intended behavior. probeManifestForRef guards against URL-injection
+  # characters in tag/repo components before constructing the URL; the
+  # remaining taint path is inherent to the product's design rather than a
+  # vulnerability. Excluding this file so the query still catches real SSRF
+  # from untrusted multi-tenant or external input elsewhere.
+  - exclude:
+      id: js/request-forgery
+      paths:
+        - backend/src/services/registry-api.ts