Extend policy to cover Docker Hub

[wkoot]

Various ICTU GitHub repos also publish directly to Docker Hub, but we don't have any guidelines for this platform.
Docker Hub offers security insights much like GitHub, both through static analysis and continuous analysis (Docker Scout).
It is also possible to add OCI artifacts such as SBOMs - https://docs.docker.com/docker-hub/oci-artifacts/

[fniessink]

Add that Docker Hub images should have read-only tags (can only be set per Docker Hub repo individually, unfortunately).