fix(security): drop the image_tag suppressions main's bumps left stale

Merging main brought in the image bumps of keycloak sso_proxy (v7.15.6),
mattermost (12.1.0), nextcloud context_agent (2.11.0) and the three wazuh
services (4.14.10). Main carries no suppressions yet, so those bumps
skipped the updater's drop_image_tag_entries, and six entries on this
branch still named the old tags. test_cve_suppressions rejects every one
of them ("does not match its version").

The six blocks are removed exactly as drop_image_tag_entries removes them
on a bump: the output of that function on HEAD is identical to the
staged files. Scan verdicts do not change, because hlth-runtime matches
an image_tag entry only against the running tag (script.py:781) and no
deployment runs the old tags any more. A new tag that still ships a
fixable CRITICAL is reported by the scan instead of being suppressed
unseen.

Before: test_cve_suppressions failed with 6 entries. After: it passes,
together with the suppression unit tests and all 119 services lints.

| 🎯 Fix | 💥 Break | 💸 Cost | ⏱️ Time | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 97 % | 1 % | – | – | ~100 % | 96 | ⏳ score passes, gate.py not run |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-keycloak/meta/services.yml

@@ -101,11 +101,6 @@ sso_proxy:
   mem_reservation: "64m"
   mem_limit: "128m"
   pids_limit: 256
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "v7.15.5"
-        until: 2026-12-03
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 postgres:
   bond: 1

roles/web-app-mattermost/meta/services.yml

@@ -65,11 +65,6 @@ mattermost:
     - web-app-stalwart
     - web-app-mailu
   lifecycle: beta
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "12.0.2"
-        until: 2026-12-03
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 redis:

roles/web-app-nextcloud/meta/services.yml

@@ -169,11 +169,6 @@ context_agent:
     path: heartbeat
     # nocheck: healthcheck-timing-override  a sidecar of a stack whose main service alone takes minutes; the value predates this default and has not been measured against it
     start_period: 20m
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "2.10.0"
-        until: 2026-12-03
 # nocheck: playwright-service-flag  MCP sidecar, no browser surface
 # nocheck: dynamic-flag  the sidecar fronts this role's MCP surface, so it tracks the role's own mcp flag rather than one client's presence
 contextagentmcp:

roles/web-app-wazuh/meta/services.yml

@@ -84,11 +84,6 @@ manager:
       agent_events: 1514
       agent_registration: 1515
       api: 55000
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 indexer:
   healthcheck:
     test:
@@ -119,11 +114,6 @@ indexer:
       http: 9200
     local:
       http: 8097
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 console:
   image: wazuh/wazuh-dashboard
   version: "4.14.10"
@@ -139,11 +129,6 @@ console:
       http: 5601
     local:
       http: 8096
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 
 # nocheck: playwright-service-flag
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in