fix(security): refresh client trust and adopt corrected upstream SearXNG (#6791)

Select the official immutable SearXNG release with corrected system and certifi stores in all Compose deployments. Retain native offline, actual-entrypoint and Compose/live regression checks while removing the custom trust-repair image and registry publication path. Reuse the canonical CA inventory checker.

Include released Python, certifi, grpcio, uv and Docker CLI trust updates and strict fourteen-chain validation. Keep unreleased CPython verifier and native-helper fixes separate from claims about shipped artifacts.

Part of #6784 and #6790.

Co-authored-by: Léo <leograndcontact@gmail.com>

.github/searxng-validation.compose.yml

@@ -0,0 +1,21 @@
+# CI-only isolation; retain the service's entrypoint, healthcheck and capabilities.
+services:
+  searxng:
+    image: ${SEARXNG_VALIDATION_IMAGE:?set the image being validated}
+    ports: !reset []
+    volumes: !override
+      - searxng-validation-data:/etc/searxng
+      - ${SEARXNG_VALIDATION_CHECKS:?}/settings.yml:/tmp/searxng-settings.yml.template:ro
+      - ${SEARXNG_VALIDATION_CHECKS:?}/migrate_searxng_settings.py:/tmp/migrate-searxng-settings.py:ro
+      - ${SEARXNG_VALIDATION_CHECKS:?}:/opt/odysseus-checks:ro
+    networks: !override
+      - default
+    restart: "no"
+
+networks:
+  default: {}
+
+volumes:
+  searxng-validation-data:
+    external: true
+    name: ${SEARXNG_VALIDATION_VOLUME:?}