Pin the Node.js version via `.config.rde.qovery.yml` and harden the NodeSource install

Start with the template Dockerfile and the documented .config.rde.qovery.yml source of truth for component versions. Trace how the nodejs value reaches the NodeSource installation, then build the image and verify that node and npm run successfully with a reproducible version and no unverified curl-to-bash setup.

Problem

In the template Dockerfile, Node.js is installed by piping the NodeSource setup script into bash:

# Node.js 22 LTS
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

Two weaknesses:

1. Loose version pin. setup_22.x pins only the major version — the subsequent apt-get install nodejs pulls the latest 22.x available at build time, so the exact Node minor/patch varies build-to-build with no record of what shipped.
2. No integrity check. The setup script is fetched and executed via curl … | bash with no checksum, so a changed or compromised script runs undetected.

Proposed change

Declare the Node.js version in .config.rde.qovery.yml — the documented source of truth for component versions in the RDE install flow (see Qovery/documentation#143). The nodejs key accepts a version string (default 22):

# .config.rde.qovery.yml
nodejs: "22"   # pin to the intended major; pin tighter if the install path allows

Where the install path allows, also tighten reproducibility and integrity: pin the installed nodejs apt package to an exact version, and prefer a verified keyring-based NodeSource apt setup over piping the setup script straight into bash.

Acceptance criteria

• The Node.js version is declared in .config.rde.qovery.yml, not hardcoded inline in the Dockerfile
• The installed Node.js version is reproducible across builds (pinned as tightly as the install path supports)
• The NodeSource setup is not executed from an unverified curl … | bash (use a checksum or keyring-verified apt source)
• Image builds successfully and node/npm run in the container