fix: resolve CVE-2026-23410 (HIGH) linux-libc-dev apparmor race condition

[Copilot]

linux-libc-dev 6.8.0-85.85 contains a use-after-free in AppArmor's rawdata handling — concurrent open() on a rawdata file and profile removal can race, leaving i_private as a dangling pointer in seq_rawdata_open(). Fixed in 6.8.0-106.106.

Changes

• .devcontainer/Dockerfile: Replaced the separate apt-get -y upgrade linux-libc-dev call with an explicit entry in the primary apt-get install block, ensuring the latest available linux-libc-dev (≥ 6.8.0-106.106) is fetched from Ubuntu 24.04 security/updates repos on every image build.

# Before
apt-get -y install --no-install-recommends python3 python3-venv python3-pip sudo \
  && apt-get -y upgrade linux-libc-dev

# After
apt-get -y install --no-install-recommends python3 python3-venv python3-pip sudo linux-libc-dev

Version pinning to the exact 6.8.0-106.106 was intentionally avoided — apt's = pinning would break builds once Ubuntu advances to a newer revision, trading one vulnerability for a brittle image.