build: move the warmer variants onto UBI9-micro and correct the shell claims

The warmer variants (:<tag>-warmer, :<tag>-fips-warmer) ran on UBI9-minimal with a microdnf install ca-certificates tzdata layer, the only reason it needed the heavier base. The standard variant already runs on UBI9-micro with no package install: its trust store is the builder stage's own CA bundle copy at /out/kaniko/ssl/certs/ca-certificates.crt, asserted non-empty and named by SSL_CERT_DIR, independent of whatever the runtime base ships. This moves Dockerfile.warmer's runtime stage onto UBI_MICRO_IMAGE, drops the microdnf block, and matches the ARG, LABEL, COPY and ENV lines to Dockerfile.standard line for line. No tzdata: without it the Go runtime falls back to UTC, as the standard variant already does; neither binary needs more than registry manifests and a local cache directory.

Correction to published docs: proving the change below turned up a pre-existing documentation error, not one this MR introduces. README, SECURITY.md, CONTRIBUTING.md, .gitlab-ci.yml's comments, and both Dockerfiles' header comments described the standard and warmer variants, and their FIPS builds, as carrying no shell. They carry bash and a full coreutils set; verified against the raw registry.access.redhat.com/ubi9-micro base, the already-published v1.25.19 standard image (138 entries in /bin, an rpm database present, no package manager), and Dockerfile.standard, which has no shell-stripping step. What UBI9-micro actually omits, and UBI9-minimal carries, is a package manager. A second commit in this MR corrects that language across all four UBI9-micro rows to say so; it changes no FROM, RUN, or ENTRYPOINT instruction. The standard and FIPS images change in exactly one label string and nothing else: LABEL org.opencontainers.image.description carried the same false "shell-free" claim, baked into the image itself, and this commit corrects it there too. The warmer and FIPS-warmer images change by design through the first commit's base move, and their label gets the same correction.

.gitlab-ci.yml's warmer build jobs never referenced UBI_MINIMAL_IMAGE in build_args, so only the header table and section comments needed correcting. The warmer-roundtrip and warmer-fips-roundtrip smoke jobs already invoke the published image through docker-in-docker against its own ENTRYPOINT, the same pattern the standard smoke jobs use; only a stale comment claiming the warmer carried a shell changed, no script logic did.

README, SECURITY.md and the docs site drop the warmer rows' UBI9-minimal base and /bin/sh entries for UBI9-micro, matching the standard row; the second commit then corrects what that row says for both variants together.

Proof, all local with podman:

1. podman build -f Dockerfile.warmer --build-arg GO_OVERRIDES="$(scripts/go-overrides.sh --label)" -t warmer-micro:local . succeeds and tags the image.
2. podman run --rm --entrypoint /bin/sh warmer-micro:local -c 'echo x' prints x and exits 0, matching the standard variant and covered by the docs correction above.
3. Warmer-to-executor round trip: the local warmer image fills a cache volume with registry.access.redhat.com/ubi9-minimal:9.8, then the published v1.25.19 executor reads it back and logs Found sha256:55443bd3d9272fd166145bc19042f976b7c6cc8ca2112b2461936d5d09740f4d in local cache, followed by BUILD SUCCEEDED/--no-push and a non-empty output tarball. This needs the warmer and executor built for the same platform; a mixed arm64/amd64 pair on Apple Silicon resolves different manifest digests for the same tag and never hits the cache.
4. Size: the local build is 45,359,368 bytes (linux/amd64, matching the published platform). The current v1.25.19-warmer on UBI9-minimal is 130,659,268 bytes. About 85 MB smaller, mostly the RPM database and microdnf's installed packages that UBI9-minimal carries and UBI9-micro does not.

podman run --rm warmer-micro:local --help prints the warmer's usage, confirming the binary runs under the new base.

scripts/check-versions.sh, shellcheck scripts/*.sh and glab ci lint pass on both commits.