Bump duo-cli to 9.25.0

Kinshuk Singhrequested to merge
bump-duo-cli-9.25.0 into main

What

Bumps DUO_CLI_VERSION from 9.23.0 to 9.25.0 in the hardened stage ARG, pins the new SHA-256 digests, and updates the duo-cli row in both runtime inventory tables in README.md (Default and Hardened).

Duo CLI 9.25.0 declares the grep_fixed_strings client capability. CI jobs skip the CLI download when the image already has duo, so CI-triggered flows only pick up 9.25.0 once the image ships it.

Companion MR (Rails bump and docs): gitlab-org/gitlab!257639 (merged)

Related to gitlab-org/gitlab#629436 (closed)

🤖 Generated with Claude Code

Merge request reports