fix(dockerfile): resolve build ARG default value in CKV_DOCKER_7 base…

[ArquimedesMonteiro]

Description

Fixes a false positive in CKV_DOCKER_7 when the FROM instruction references a build ARG whose default value already pins a specific tag, e.g.:

ARG BASE_IMAGE=node:18.17.0
FROM ${BASE_IMAGE}

Previously this was reported as a violation, because the check only saw the literal string ${BASE_IMAGE} and never resolved it against the ARG declaration.

Fixes #7667

New/Edited policies (Delete if not relevant)

Description

CKV_DOCKER_7 ("Ensure the base image uses a non latest version tag") was registered with supported_instructions = ("FROM",), so it never had access to the file's ARG instructions and could not resolve variable references used in FROM.

Fix

Changed the check to a wildcard check (supported_instructions = ("*",), following the same pattern already used by HealthcheckExists/UserExists), so it now receives the full per-file instruction dictionary. It builds a map of ARG names to default values and resolves FROM ${VAR} / FROM $VAR against that map before evaluating the tag. No user action is required to benefit from the fix.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes