Bump duo-cli to 9.30.0

What

Bumps DUO_CLI_VERSION from 9.29.0 to 9.30.0 in the global Dockerfile ARG, pins the new SHA-256 digests, and updates the duo-cli row in both runtime inventory tables in README.md (Default and Hardened).

Duo CLI 9.30.0. CI jobs skip the CLI download when the image already has duo, so CI-triggered flows only pick up 9.30.0 once the image ships it.

Digests are taken from the package registry listing via scripts/renovate-post-upgrade.sh duo-cli 9.29.0 9.30.0 and were also confirmed by downloading duo-linux-{x64,arm64} and hashing them locally:

Binary	SHA-256
duo-linux-x64	a2be8cd06e1d5a8a7c3beee0538cf294f6200b3fc5a9d33ca7cf8c5e1e5bbf39
duo-linux-arm64	d36539da66be498a0d6527cd9aaef251a6acd7a6549998d6fb52d54f08c43363

Companion MR (Rails bump and docs): gitlab-org/gitlab!261426 (closed)

Renovate manages this pin and may propose the same bump; this MR supersedes it.