[WIP] Update container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 - #53137

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1</issue_title>
<issue_description>### Overview

Daily container scan findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 (pinned sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f).

Key metrics

Severity	Count
Critical	0
High	0
Medium	4
Low	0
Negligible	0
Unknown	0
License violations	11

Vulnerabilities

Medium (4)

CVE/GHSA	Package	Fixed version
CVE-2025-60876	busybox@1.37.0-r31	none published
CVE-2025-60876	busybox-binsh@1.37.0-r31	none published
CVE-2025-60876	ssl_client@1.37.0-r31	none published
CVE-2026-58055	nghttp2-libs@1.69.0-r0	none published

License violations

License violations (11)

Package	License
acl-libs@2.3.2-r1	GPL-2.0-or-later, LGPL-2.1-or-later
libcom_err@1.47.4-r0	GPL-2.0-or-later, LGPL-2.0-or-later
bind-libs@9.20.26-r0	MPL-2.0
logrotate@3.22.0-r0	GPL-2.0-or-later
squid@7.6-r0	GPL-2.0-or-later
userspace-rcu@0.15.3-r0	LGPL-2.1-or-later
xz-libs@5.8.3-r0	0BSD, AND, GPL-2.0-or-later, LGPL-2.1-or-later, Public-Domain
bind-tools@9.20.26-r0	MPL-2.0
keyutils-libs@1.6.3-r4	GPL-2.0-or-later, LGPL-2.0-or-later
mii-tool@2.10-r3	GPL-2.0-or-later
libltdl@2.6.0-r1	LGPL-2.0-or-later, GPL-2.0-or-later

Next actions

• No High/Critical CVEs in this image; the 4 Medium findings are all pending upstream Alpine advisories (busybox, ssl_client, nghttp2-libs) — track and rebuild once patched packages are published.
• All 11 license findings are copyleft (GPL/LGPL/MPL) licenses on base OS packages already permitted by the squid/Alpine distribution; confirm these are covered by the project's existing license allowlist/exception policy, or add explicit exceptions if the policy should reject copyleft licenses in this image.
• This image is rebuilt weekly via the daily gh aw compile --force-refresh-container-pins job.

Generated by 🛡️ Daily Container Image Security Scan · auto · 438.5 AIC · ⌖ 15.1 AIC · ⊞ 7.2K · ◷

• Closes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 #53073

Comments on the Issue (you are @copilot in this section)

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 #53073