Bump DAP workflow image path to v0.0.22

What does this MR do and why?

Bumps the default flow executor image from workflow-generic-image:v0.0.21 to v0.0.22 in StartWorkflowService, and updates the docs to match.

Why

!260311 (merged) bumped DUO_CLI_VERSION to 9.29.0 so flows in headless CI mode can read images (gitlab-org/editor-extensions/gitlab-lsp!4393 (merged)). That fix only takes effect when the job runs Duo CLI 9.29.0. The default image v0.0.21 has Duo CLI 9.27.0 preinstalled at /usr/local/bin/duo. Flows using the default image, which is most of them, would therefore still refuse image reads with capability_absent.

v0.0.22 is the first default image that ships Duo CLI 9.29.0:

• Bump MR: gitlab-org/duo-workflow/default-docker-image!55 (merged)
• Tag pipeline (build, container scanning, release, sign): https://gitlab.com/gitlab-org/duo-workflow/default-docker-image/-/pipelines/2931296509

v0.0.22 contains no other changes. The only difference from v0.0.21 is the Duo CLI version (9.27.0 → 9.29.0) and its SHA-256 pins. It applies to both workflow-generic-image and workflow-generic-image-hardened.

How to set up and validate locally

1. Confirm the image ships the expected CLI:

   docker run --rm registry.gitlab.com/gitlab-org/duo-workflow/default-docker-image/workflow-generic-image:v0.0.22 duo --version

   Expected: 9.29.0.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.