Mitigate github-mcp-server container findings by repinning image and allowlisting Debian base licenses

[Copilot]

The container scan flagged critical/high findings on the pinned github-mcp-server:v1.9.0 digest and repeated license violations from expected Debian runtime packages. This change repoints workflows to a newer immutable MCP server image digest and updates license policy to stop false-positive base-layer license failures.

• MCP server image repin

  • Switched the default GitHub MCP server image selector from v1.9.0 to sha-eff4c3c (DefaultGitHubMCPServerVersion).
  • Refreshed container pin data so compiled workflows now resolve to:
    • ghcr.io/github/github-mcp-server:sha-eff4c3c@sha256:b01342609bd4203ddf3eee401b9297b82e7796f569b34fa96dfcfb6bd213d33e

• Feature compatibility for non-semver channels

  • Updated GitHub MCP feature gating so non-semver channels (sha-*, main, nightly, edge) continue to receive default fields_param behavior.

• License policy alignment for Debian runtime layers

  • Extended .grant.yaml allowlist with Debian base-layer licenses observed in scan output (GPL/LGPL variants, HPND, Spencer-94, Artistic, public-domain, ad-hoc), matching expected OS package licensing.

• Generated artifact refresh

  • Regenerated container pin caches and compiled lockfiles to propagate the new MCP image reference across workflow manifests.

// pkg/constants/version_constants.go
const DefaultGitHubMCPServerVersion Version = "sha-eff4c3c"

• Fixes [container-image-scan] Container findings for github-mcp-server #51973