Upgrade base packages in the runtime image - #157

The runtime stage is built from crazymax/alpine-s6:3.24-2.2.0.3, whose last release
(2.2.0.3-r30, 2026-07-13) is based on Alpine 3.24.1. Since the Dockerfile only runs
apk add, packages inherited from the base image are never updated, so current images
still ship outdated libraries even though Alpine 3.24 has fixes, e.g.:

• brotli-libs 1.2.0-r1 -> 1.2.1-r0 (CVE-2026-111497, out-of-bounds write in the Brotli decoder, CVSS 8.1)
• libssl3/libcrypto3 3.5.7 -> 3.5.9, zlib 1.3.2 -> 1.4, musl 1.2.6-r2 -> r3

Found with Trivy on ghcr.io/crazy-max/msmtpd:1.8.34
(docker run --rm --entrypoint sh ghcr.io/crazy-max/msmtpd:1.8.34 -c 'apk update -q; apk list -u'
lists 12 upgradable packages).

This runs apk upgrade before installing the runtime packages, so each build picks up
the current Alpine security fixes regardless of when the s6 base image was last rebuilt.

Alternatively, a rebuild of crazymax/alpine-s6 would fix it for all images using it.