Add hadolint for Dockerfile linting

What does this MR do?

• Adds hadolint to the local dev tools (managed by Mise).
  • Note: hadolint is already present in the runner-linters image used in CI.
• Adds Make targets for linting Dockerfiles.
• Adds the dockerfile:lint MR pipeline job, which lints Dockerfiles.

Why was this MR needed?

Dockerfiles are not linted currently, which is a gap in our code quality enforcement.

What's the best way to test this MR?

• Run mise install && make lint-dockerfiles locally.
• Check the relevant CI job: dockerfile:lint in the qa stage.

Existing issues flagged by hadolint should appear. These will be fixed in a follow-up MR.

What are the relevant issue numbers?

Closes #25412 (closed)