fix(coturn): pin the image, drop the last :latest tag

The running container was 4.10.0 while :latest had moved on to 4.17.2 — with
imagePullPolicy IfNotPresent the node keeps whatever it pulled once, so nobody
knew what was actually running and the next reschedule onto a fresh node would
have jumped seven minor versions silently. That is the concrete case #0052 is
about, and it also explains why the CVE scanner reported against a moving target.

Pinned to 4.17.2, which is both current and what :latest resolves to today, so the
scan results finally describe the thing that runs. The config uses only long-lived
core options (realm, use-auth-secret, relay-ip, cert/pkey), none of them removed
in that range. busybox in the init container goes 1.28 to 1.36, the version this
repo already uses elsewhere.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/production/coturn.yaml

@@ -94,7 +94,9 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       initContainers:
       - name: init-config
-        image: busybox:1.28
+        # Gepinnt und aktuell gehalten (#0052); 1.36 ist die im Repo bereits
+        # anderswo genutzte Version — ein Stand statt zwei.
+        image: busybox:1.36
         command:
         - sh
         - -c
@@ -119,7 +121,12 @@ spec:
           readOnly: true
       containers:
       - name: coturn
-        image: coturn/coturn:latest
+        # Gepinnt statt ':latest' (#0052). Vorher lief hier 4.10.0, waehrend ':latest'
+        # laengst auf 4.17.2 zeigte: mit imagePullPolicy IfNotPresent haelt der Node das
+        # einmal gezogene Image fest, und der naechste Pod-Neustart auf einem frischen
+        # Node waere still ueber sieben Minor-Versionen gesprungen. Genau deshalb ist
+        # ':latest' weder reproduzierbar noch sinnvoll scanbar.
+        image: coturn/coturn:4.17.2
         imagePullPolicy: IfNotPresent
         ports:
         - name: stun-udp