fix(security): patch postcss and pin the glibc-floor image

Two open security alerts.

Dependabot #13 (GHSA-r28c-9q8g-f849, high): postcss path traversal via
sourceMappingURL auto-loading. Transitive dev dependency of vite, so it never
ships in the binary, but the fix is a clean lockfile bump -- vite requires
^8.5.3 and the patch floor is 8.5.18, so 8.5.24 satisfies it with no dependency
graph change. Verified: npm ci resolves and the UI still builds.

Scorecard DeusData#76 (PinnedDependenciesID): Dockerfile.glibc22 used a floating
`ubuntu:22.04`. Every other venue image is digest-pinned; this one was missed.
It matters more here than the checkbox suggests -- that image IS the glibc-floor
assertion, the oldest userland we claim the portable binary runs on. A floating
tag means the floor silently drifts to whatever 22.04 points at, and a floor
that moves is not a floor.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

graph-ui/package-lock.json

@@ -6,7 +6,11 @@
 #   2. the DYNAMIC binary refuses to start (its glibc 2.38+ floor is by
 #      design — old-glibc coverage is the portable binary's job, and a
 #      dynamic binary that silently ran here would mask a floor regression).
-FROM ubuntu:22.04
+# Pinned by digest like every other venue image: a floating tag means the
+# glibc-FLOOR assertion silently drifts to whatever ubuntu:22.04 points at, and
+# a floor that moves is not a floor. (Scorecard PinnedDependenciesID #76 — this
+# was the one image the pinning pass missed.)
+FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         bash \