Release 2.58 (#5952)

* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore

.dockerignore

@@ -0,0 +1,76 @@
+# Secrets and local environment
+.env
+.env.*
+!.env.dist
+.dockerhub.secrets
+config/secrets/*
+
+# Git and CI
+.git
+.gitattributes
+.gitignore
+.github
+
+# Build artifacts and dependencies (installed inside the image)
+vendor/
+node_modules/
+public/bundles/
+.pnpm-store/
+.yarn/
+.yarnrc.yml
+.pnp.*
+
+# Symfony runtime data — exclude contents but keep the directories themselves
+# (the dirs are tracked in git via .gitkeep and code expects them to exist)
+var/advisories/
+var/cache/*
+var/log/*
+var/sessions/*
+var/data/*
+var/dev/*
+var/invoices/*
+var/export/*
+var/packages/*
+var/plugins/*
+var/templates/*
+!var/**/.gitkeep
+
+# IDE, tools, caches
+.idea/
+.claude/
+.vscode/
+.php-cs-fixer.cache
+.php_cs.cache
+.phpunit.result.cache
+.phpunit/
+nbproject/
+
+# Dev-only configs
+test/
+.php-cs-fixer.dist.php
+php-cs-fixer.sh
+phpstan.sh
+phpstan.neon
+phpstan-baseline.neon
+eslint.config.mjs
+.editorconfig
+.codecov.yml
+phpunit.xml
+phpunit.xml.dist
+
+# Docker and compose (not needed inside the image; .docker/ is copied explicitly)
+docker-compose.yml
+docker-compose.*.yml
+Dockerfile
+.dockerignore
+
+# OS junk
+.DS_Store
+Thumbs.db
+
+# Local Symfony overrides
+public/.user.ini
+php.ini
+.php-version
+config/packages/local.yaml
+config/bundles-local.php