ci: self-contained secs_server image for secs4j interop

The harness previously bound the source tree into a compose service
and built inside it.  That breaks under docker-in-docker (gitea-act,
GitHub Actions runners with /var/run/docker.sock mounted) because
bind-mount sources resolve against the *host* daemon's filesystem,
not the runner container's.  Now Dockerfile.server bakes a Release
secs_server into its own image, and secs4j_validate.sh wires server
and harness together on a dedicated bridge — no volumes needed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.dockerignore

@@ -1,4 +1,5 @@
 build/
+build-*/
 .git/
 .gitignore
 *.md