fix: harden Docker dev environment (#6621)

* fix: harden Docker dev environment and add smoke tests

Address Copilot review feedback from #6618: input validation on DB
env vars in entrypoint, scoped AllowOverride, localhost-only DB port
binding, security headers (Referrer-Policy, Permissions-Policy,
X-Permitted-Cross-Domain-Policies), reduced php-fpm worker count,
expose_php disabled, and .env excluded from git.

Adds tests/tools/check_docker.sh — 29-point smoke test covering
build, health, PHP extensions, config generation, cron, HTTP,
security headers, and DB connectivity.

* Update docker/entrypoint.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: address Copilot and TheWitness review feedback

tests/tools/check_docker.sh:
- shebang: #!/bin/bash -> #!/usr/bin/env bash (consistent with repo)
- add GPL copyright header (2004-2026)
- fix grep pattern: single-quoted '^${ext}$' never expanded variable;
  use double quotes so extension name is actually matched
- add opcache to REQUIRED_EXTS (TheWitness)

docker/entrypoint.sh:
- shebang: #!/bin/bash -> #!/usr/bin/env bash

docker/Dockerfile:
- rrdtool comment: clarify that 1.9+ enables graph tooltip output via
  graphv, not merely "hover tooltips" (TheWitness)

docker/apache.conf:
- X-XSS-Protection: add TODO comment noting it is deprecated and that
  Cacti sets its own headers at the application layer (TheWitness)

---------

Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

.dockerignore

@@ -1,6 +1,7 @@
 .git
 .github
 *.md
+!README.md
 LICENSE
 .phpstan*
 .php-cs-fixer.php