Pin Authelia v4.39.28 by digest (plus-address LDAP filter fix)

Operator rollout 2026-09-24 from the floating 4.38 tag. Schema migrated
15 -> 29; first start hit a transient LDAP dial error and restarted clean.
Verified: health 200, discovery 200, '+' username now a clean not-found,
KeyCape checks unchanged. Rollback: sha256:46021dc2... plus
backups/db.sqlite3.pre-4.39.28.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

sso-mfa/k8s/authelia/deployment.yaml

@@ -45,7 +45,7 @@ spec:
       containers:
         - name: authelia
           # Pin to a specific 4.x release. Check https://hub.docker.com/r/authelia/authelia
-          image: authelia/authelia:4.38
+          image: docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54  # v4.39.28
           imagePullPolicy: IfNotPresent
 
           ports: