fix: make the nginx config readable by the unprivileged user

COPY keeps the source file's mode; a 600 file (local checkouts) left
uid 101 unable to read it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

Dockerfile

@@ -16,6 +16,6 @@ COPY --from=builder /build/coverage /
 FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
 MAINTAINER Joakim Olsson <joakim@unbound.se>
 
-COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
-COPY ./nginx/security_headers.conf /etc/nginx/security_headers.conf
+COPY --chmod=644 ./nginx/nginx.conf /etc/nginx/nginx.conf
+COPY --chmod=644 ./nginx/security_headers.conf /etc/nginx/security_headers.conf
 COPY --from=builder /build/.output/public/ /usr/share/nginx/html/