build-godynamic: pin patched grpc in docker-compose (GHSA-hrxh-6v49-42gf) (#105)

The published build-godynamic:latest dropped below Docker Scout grade A on a
new fixable HIGH: google.golang.org/grpc 1.81.1 (GHSA-hrxh-6v49-42gf, uncaught
exception, fixed in 1.82.1), bundled transitively by the from-source
docker-compose v5.2.0 build.

Pin google.golang.org/grpc@v1.82.1 in the compose `go get` — the same
from-source transitive-pin pattern already used for gotestsum/golangci-lint/
git-lfs. Verified locally: the rebuilt image bakes grpc v1.82.1 into the
docker-compose plugin and the VEX-aware scout-cve-gate passes (only the
VEX-waived CVE-2026-34040 remains).

Non-breaking: no change to USER, entrypoint, base, or the compose version;
just an upgraded transitive dep. Tracks scout-drift issue #104 (sla:high).

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

images/Dockerfile.build-godynamic

@@ -89,9 +89,13 @@ RUN apk add --no-cache gcc git musl-dev && \
     go build -o /go/bin/git-lfs "github.com/git-lfs/git-lfs/v3" && \
     cd / && rm -rf /tmp/gitlfs
 ARG DOCKER_COMPOSE_VERSION
+# Built from source so we can pin a patched google.golang.org/grpc
+# (GHSA-hrxh-6v49-42gf — uncaught exception, fixed in 1.82.1); compose v5.2.0
+# otherwise bundles the vulnerable grpc 1.81.1. Drop the pin once compose
+# requires grpc >= 1.82.1 transitively.
 RUN mkdir /tmp/compose && cd /tmp/compose && \
     go mod init _compose && \
-    go get "github.com/docker/compose/v5/cmd@v${DOCKER_COMPOSE_VERSION}" && \
+    go get "github.com/docker/compose/v5/cmd@v${DOCKER_COMPOSE_VERSION}" google.golang.org/grpc@v1.82.1 && \
     go build -o /go/bin/docker-compose "github.com/docker/compose/v5/cmd" && \
     cd / && rm -rf /tmp/compose