Pin JDK base images by digest; produce JDK 17 (3.x) and JDK 21 (4.x) variants

[jaymcnallie]

Summary

• Pins azul/zulu-openjdk-alpine and matejak/argbash by image digest via ARG defaults; downstream rebuilds are now bit-for-bit reproducible.
• Converts CI to a matrix that produces two image trains from the same Dockerfile:
  • JDK 17 (Zulu 17.0.19-17.66): published as codice/ddf-base:3.1, :3.1-jdk17, :jdk17-latest — for DDF 2.30.x maintenance + Alliance 1.17.x.
  • JDK 21 (Zulu 21.0.11-21.50): published as codice/ddf-base:4.0, :4.0-jdk21, :jdk21-latest — for DDF master (post Bump to 2.31.0-SNAPSHOT and target JDK 21 ddf#6999 → 2.31.0 on JDK 21).
• Drops the floating codice/ddf-base:latest tag. Consumers must pick a JDK-pinned tag; this avoids the regression class that produced an unbootable Alliance 1.17.4 (Java 8 image + Java 17 setenv).
• README features section: "Oracle JDK8" → accurate JDK 17/21 description.
• Changes LABEL maintainer from oconnormi to codice.

Test plan

• docker build for JDK 17 variant succeeds locally; java -version reports Zulu17.66+19 / 17.0.19.
• docker build --build-arg JAVA_BASE=<zulu-21-digest> succeeds; java -version reports Zulu21.50+19 / 21.0.11.
• CI matrix workflow runs green on this PR.
• Sanity check by a downstream consumer build (codice/alliance Docker module) after merge — separate PR will pin <docker.ddf.base.version> to 3.1@sha256:<resulting-digest>.

Follow-ups (not in this PR)

• codice/alliance PR to pin <docker.ddf.base.version> to the new JDK-17 digest.
• codice/ddf PR to do the same in its Docker module (and switch to JDK 21 tag whenever Bump to 2.31.0-SNAPSHOT and target JDK 21 ddf#6999 lands).