ci: publish multi-arch (amd64/arm64) OCI images to GHCR

[snarlysodboxer]

Summary

Add CI to build and publish multi-arch (linux/amd64 + linux/arm64) OCI images for both ogmios (standalone) and cardano-node-ogmios (bundled) to GHCR, and make the Dockerfile and Nix builds arch-aware to support it.

OCI Images

Image tags generally follow the upstream pattern comprising 3 parameters:

• $ogmios_version — ogmios release, e.g. v6.14.0.3
• $cardano_node_version — cardano-node, e.g. 11.0.1
• $network — mainnet, preprod, or preview

Image	Tag	Type
ghcr.io/intersectmbo/ogmios	:$ogmios_version	versioned standalone Ogmios
ghcr.io/intersectmbo/ogmios	:latest	rolling standalone Ogmios
ghcr.io/intersectmbo/cardano-node-ogmios	:${ogmios_version}_${cardano_node_version}-$network	versioned bundle, per network
ghcr.io/intersectmbo/cardano-node-ogmios	:latest-$network	rolling bundle, per network
ghcr.io/intersectmbo/cardano-node-ogmios	:${ogmios_version}_${cardano_node_version}	versioned bundle, mainnet alias
ghcr.io/intersectmbo/cardano-node-ogmios	:latest	rolling bundle, mainnet alias

mainnet is the default network, so it additionally receives the two unqualified aliases
(:${ogmios_version}_${cardano_node_version} and :latest) on top of its -$network tags.

Individual architecture tags can also be found suffixed with -amd64 or -arm64 on the versioned and per-network tags.

Other Changes

• Add SECURITY.md.
• Add a GHA-hardening Claude skill.
• Bump versions for release prep.
• Bump the server/config submodule.