Publish version-tagged PHP images so Dependabot can keep consumers updated

[maia-andre]

Context

In LibreSign/libresign#8001, the devcontainer default PHP image had to be bumped manually from php82 to php83 after Nextcloud master dropped PHP 8.2 support (see LibreSign/libresign#7985). In the review, @vitormattos suggested:

As a follow-up, we can create an issue in nextcloud-docker-development to review the image/tag naming so Dependabot can help keep the devcontainer PHP version updated in the future.

This is that issue.

Problem

Dependabot cannot keep consumers of these images up to date, for two reasons:

1. The PHP version is embedded in the image name, not the tag. The images are published as ghcr.io/librecodecoop/nextcloud-dev-php81|php82|php83, each tagged :latest and :<sha>. Dependabot's docker ecosystem only updates version-like tags — it never rewrites the image name, so a -php82 → -php83 move is invisible to it. And :latest is not a version-like tag, so there is nothing for it to bump.
2. Consumers reference the image through variable interpolation. E.g. LibreSign's devcontainer uses ghcr.io/librecodecoop/nextcloud-dev-php${PHP_VERSION:-83}:latest, which Dependabot cannot parse.

Proposal

Publish a single version-tagged image in addition to the current names, from the same build matrix in .github/workflows/docker-php.yml:

• ghcr.io/librecodecoop/nextcloud-dev:8.1, :8.2, :8.3 (+ :<version>-<sha> for pinning)
• Keep publishing nextcloud-dev-php8X:latest / :<sha> unchanged, so existing consumers (LibreSign stable branches, other apps, local .env files) are not broken and can migrate at their own pace.

Then, on the consumer side (e.g. LibreSign/libresign):

• Reference a literal tag in .devcontainer/docker-compose.yml: image: ghcr.io/librecodecoop/nextcloud-dev:8.3
• Add a docker ecosystem entry for /.devcontainer to dependabot.yml

From then on, when a new PHP version image is published (e.g. :8.4), Dependabot opens the bump PR automatically in each consumer repo.

Notes

• The first push of the new nextcloud-dev package to GHCR will create it as private by default — a maintainer needs to set its visibility to public once.
• The docker-compose.yml in this repo could later also move to nextcloud-dev:${PHP_VERSION:-8.3}, but that is optional and can be done separately (switching versions via .env remains a valid use case here).

I can send a PR with the workflow change if this direction makes sense.