Upgrade CrowdSec to v1.6.8 and Alpine base image to v3.21.3

[stephdl]

Brief description
We request to upgrade the following container images:

• CrowdSec to v1.6.8
• Alpine base image to v3.21.3

WHY: These updates provide important security patches, improved stability, and better support for modern container environments and lightweight image builds.

PURPOSE: Enhance the security posture of our intrusion prevention stack and ensure minimal, up-to-date base layers for downstream builds.

Proposed solution

Update the Docker image reference for CrowdSec to v1.6.8.

Update any custom or dependent Dockerfiles to use alpine:3.21.3 as the base image.

Alternative solutions
Continuing with older versions may expose the system to unpatched vulnerabilities, outdated dependencies, and reduced compatibility with external tools or orchestrators. Manual patching introduces unnecessary maintenance overhead.

Additional context
CrowdSec v1.6.8 includes performance and security improvements for agent and parser modules.
Alpine 3.21.3 is a minimal, hardened base with updated packages and is ideal for maintaining small, secure containers.
Keeping both components current supports a secure and efficient containerized security infrastructure.

[stephdl]

see https://docs.crowdsec.net/docs/next/local_api/centralized_allowlists/

and https://github.com/crowdsecurity/crowdsec/releases

The whitelist must be modified to follow the new crowdsec way

[stephdl]

see also card #7374 to add sos/nethesis to whitelist dynamically

[stephdl]

QA (see also #7374)

target version : ghcr.io/nethserver/crowdsec:1.0.14-dev.2

• case 1 direct install
  try to ban yourself with ssh (think to enable the ban on local network) runagent -m crowdsec1 cscli metrics
  test the whitelist (case3)

• case 2 upgrade from 1.0.13 to 1.0.14-dev.2
  try to ban yourself with ssh (think to enable the ban on local network): runagent -m crowdsec1 cscli metrics
  test the whitelist (case3)

• case 3 test whitelist
  add some IPs, cidr, FQDn to the whitelist, in the whitelist list, add an IP and do some brute force to ssh with this IP, you must not be banned (check the log)
  check the allowlists : runagent -m crowdsec1 cscli allowlists inspect nethserver_whitelist
  check the FQDN whitelist:

runagent -m crowdsec1
cat crowdsec_config/postoverflows/s01-whitelist/nethserver-postoverflows-whitelists.yaml