Install the .NET SDK in the E2E test-runner image from a pinned source #663

Part of #607. Found while doing #617.

Why

The E2E test-runner image (tests/DfE.CheckPerformanceData.E2ETests/Dockerfile) adds the .NET 10
SDK with:

RUN curl -sSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh \
    && /tmp/dotnet-install.sh --channel ${DOTNET_CHANNEL} --install-dir /usr/share/dotnet

• The script is downloaded and run without a checksum check.
• --channel 10.0 installs whichever 10.0 SDK is newest at build time.

Since #617 the base image (playwright/dotnet) is pinned by digest, but this step is not. The
image runs the tests only. It is not deployed, and CI runs the E2E tests on the host SDK, so the
risk is to developer machines and to the repeatability of local runs.

Scope

• Take the SDK from the pinned image instead, for example
  COPY --from=mcr.microsoft.com/dotnet/sdk:10.0@sha256:<digest> /usr/share/dotnet /usr/share/dotnet,
  so Dependabot updates it with the other images. Both images are Ubuntu 24.04 (noble). Check the
  .NET 8 SDK that the Playwright image ships is not needed, or copy the 10.0 SDK in beside it.
• Otherwise, pin the script by checksum and install an exact SDK version.
• Keep the build-time check (dotnet --list-sdks | grep -E '^10\.').

Done when

• The E2E image installs a fixed SDK version from a pinned or checksum-verified source.
• make test-e2e still passes.