feat: add oCIS 8.0.8 image

[2403905]

Bump the v8 stable release matrix entry 8.0.7 → 8.0.8 in main.yml

[DeepDiver1975]

Wait. Do we need to adjust trivy ignore?

[2403905]

Wait. Do we need to adjust trivy ignore?

All checks are green. I bumped the dependencies. Any other reason to adjust trivy ignore?

[2403905]

@DeepDiver1975 Is this line commented out or I must to delete this lines after I bumped the package?

# github.com/go-git/go-git/v5 v5.19.1 (fixed in 5.19.2) — fixed in oCIS 8.2.0
CVE-2026-71556 exp:2026-10-31

[DeepDiver1975]

Reviewed the matrix bump against upstream rather than just the diff — LGTM, no blocking issues.

Verified:

• Upstream tag v8.0.8 exists (unlike the 8.0.7 PR, which was merged ahead of its tag).
• Matrix entry is internally consistent: dir: v8, trivy-ignore: v8/8.0/.trivyignore, extra-tags: 8.0 only — the floating 8 correctly stays on 8.2.0.
• Build path unchanged for 8.0.8: services/idp/package.json still present, no in-tree web/, so the Dockerfile's pull-assets fallback branch still applies; pnpm@10.28.1 matches upstream's packageManager pin (lockfileVersion: 9.0); ocis/Makefile is byte-identical to 8.0.7, so VERSION= / release-linux-docker-* handling is unaffected.
• Trivy-relevant deps all moved forward, not backward (x/net 0.57.0→0.58.0, x/text 0.40.0→0.41.0, grpc 1.82.1→1.83.1, go-git 5.19.1→5.19.2), so none of the 8.1-baselined CVEs can reach the 8.0 build.
• CI green on the PR head for all six build jobs (amd64 + arm64 across the three matrix entries), including Trivy and the .productversion smoke test.

Two low-severity consistency items — both in files this PR doesn't touch, so non-blocking; fine as follow-ups if you'd rather keep this PR a one-liner:

1. v8/8.0/.trivyignore:4 — obsolete suppression. CVE-2026-71556 was baselined for go-git v5.19.1; 8.0.8 ships v5.19.2, which is the fix. Repo convention is to drop these once upstream fixes land (a68641a removed exactly these entries from v8/8.2/.trivyignore when 8.2.0 fixed it). Downside of leaving it until exp:2026-10-31: the 8.0 scan would silently pass if a later 8.0.x pulled a transitive dep back onto a vulnerable go-git.

2. README.md:26 — Supported Tags table is stale, and this PR invalidates that row: it still reads `8.0.5`, `8.0` | 8.0.5 (now 8.0.8). Adjacent rows are stale from earlier merges too — line 25 calls 8.1.0 "latest stable" and gives it 8 (the matrix gives 8.2/8 to 8.2.0), line 24 still advertises 8.2.0-rc.1 which is no longer in the matrix, and the quick-start at line 17 pulls owncloud/ocis:8.1.0. Per agents.md this README is published verbatim as the Docker Hub description, so users are being pointed at superseded tags.

🤖 Generated with Claude Code