fix(docker): pin base image versions for reproducible builds

- golang:alpine → golang:1.25-alpine (align with go.mod's go 1.25.0)
- alpine:latest → alpine:3.23 (pin runtime base image)

Floating tags make builds non-reproducible and can drift from the
Go version declared in go.mod. Pinning both stages keeps builds
deterministic and reduces supply-chain risk.

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 ARG RELEASE=false
 ARG COMPRESS=false
@@ -13,7 +13,7 @@ RUN go mod download
 RUN RELEASE=${RELEASE} COMPRESS=${COMPRESS} mage build
 RUN mage -compile ./mage -ldflags "-s -w"
 
-FROM alpine:latest
+FROM alpine:3.23
 
 WORKDIR /openim-server