chore: update Debian to trixie (13)

[feliperalmeida]

Updating Debian to trixie, which has full support until August 9th, 2028 and two years of Long Term Support (LTS), until June 30th, 2030.

Also fixed CI issues raised by Semgrep (and then zizmor locally).

[Piccirello]

This is a risky change. How can we gain confidence that this isn't going to break anything? This repo doesn't seem to have any tests.

[feliperalmeida]

This change will build a new image: ghcr.io/posthog/rust-node-container:trixie_rust_1.91-node_24.13.0

Both places [1] [2] that use the image generated from this repo pin its version to bookworm - so we shouldn't break anything merging this. We should have tests directly on apps/services that use this image.

I updated the PR so we keep producing the bookworm image as well - at least until we can safely migrate. Producing both images allows testing the new one.