Update Docker PHP image to fix critical RCE vulnerabilities - #950

Description

The Dockerfile pins PHP 8.3.22. PHP 8.3.36 fixes CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution.

Update the Apache image to php:8.3.36-apache and pin its multi-platform manifest digest so container builds include the fixes while remaining on PHP 8.3.

Reference: PHP security advisory.

Type of change

• Bug fix

How Has This Been Tested?

• Built the Dockerfile locally and verified PHP 8.3.36.
• Tested locally with a valid username and verified the SVG card.
• Tested locally with an invalid username and verified the error SVG.
• Ran composer test: 63 tests, 6,278 assertions passed.

No application logic or test expectations change.

Checklist

• Checked existing issues and PRs, including Fix: switch Vercel deployment to container service with corrected Dockerfile #948 and Update Dockerfile #870. Neither updates the pinned PHP version for these vulnerabilities.
• The change follows the existing Dockerfile style.
• No application behavior or documentation changes are required.