Align Secure-Binaries analyzer versions with SAST templates

What does this MR do and why?

Security/Secure-Binaries.gitlab-ci.yml mirrors the analyzer images that offline scan jobs pull through SECURE_ANALYZERS_PREFIX. Since 18.0 (bd3177c3), six analyzers are mirrored at a major version the stable job templates no longer request, so their scan jobs cannot pull their image from the mirror.

This MR sets semgrep, sobelow, pmd-apex, kubesec and kics to 6 and gitlab-advanced-sast to 2, the tags in the SAST and IaC offline image lists. The spec now fails when a stable Jobs/ template and the mirror disagree on a tag.

The mirroring job also ran an old Docker client. .download_images used docker:stable, which Docker Hub last published on 2 December 2020 and which carries Docker 19.03 without buildx, as @adamcohen noted on merge request 190948. Its service used the floating docker:dind tag, which resolves to the current daemon.

This MR pins the job to docker:29.1.4 and the service to docker:29.1.4-dind. Jobs/Code-Quality.gitlab-ci.yml uses that pair, and Jobs/Build.gitlab-ci.yml and Jobs/Build.latest.gitlab-ci.yml use the service tag, so no new version enters the tree, and the daemon moves from the current release to 29.1.4. It also removes the env line, which printed the job environment, including any unmasked CI/CD variables, to the job log in a job that runs docker login. These changes are in this MR because they touch the same file and the same job, and the pin uses a version already in the tree.

Where the pull fails

sequenceDiagram
    participant M as semgrep (Secure-Binaries)
    participant R as CI_REGISTRY_IMAGE
    participant S as semgrep-sast (Jobs/SAST)
    M->>R: push semgrep:5
    S->>R: pull semgrep:6
    R->>S: not found

References

• Related to #572441 (closed)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

1. Compare the six changed tags with those in Jobs/SAST.gitlab-ci.yml and Jobs/SAST-IaC.gitlab-ci.yml.
2. Compare the image and services of .download_images with those in Jobs/Code-Quality.gitlab-ci.yml. The service command that job also sets is not part of this change.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

On this branch in a gitlab-org/gitlab development environment, RuboCop reported no offenses for the changed spec, and RSpec ran 414 examples with no failures across it and both template-wide specs, with the changed spec running last as it does in CI.

An AI coding assistant wrote this change and ran the checks above in a simulated environment: a GitLab source checkout on a test VM.