- pin UPSTREAM_REF to the v12.0 rebase commit
- move publish to dotnet SDK 10.0 and the runtime to aspnet:10.0
- pin jellyfin-web to 12.0+deb12
- bake LDAP Authentication 24.0.0.0 (targetAbi 12.0.0.0)
- build PR images with the CA-baked buildx plugin