enhancement: add rule for unpinned Docker image tags in services:

[depmedicdev-byte]

What

We catch unpinned image: references but not unpinned
services: images. Same security risk: floating tags get silently
upgraded, and a compromised upstream poisons your build.

Sketch

Add src/rules/services-no-pin.js that scans every services: entry
in every job, treats each as a Docker image reference, and flags any
not pinned to name@sha256:<digest> or at minimum a
MAJOR.MINOR.PATCH tag.

Acceptance

• New rule module + test
• README rule table updated
• Bumps version to 0.3.x

Estimate

~1 hour.

[kekius-maximus45]

@depmedicdev-byte
Hi, I’d like to work on this issue.
I’ll add a services-no-pin rule that checks services: Docker image references and flags unpinned images, following the existing rule structure in the
project. I’ll also add/update tests for pinned, unpinned, and allowed service image formats.

Please assign this to me if it’s still available.