v1.2.19 Enhance security by replacing certificate skipping with certificate fingerprint verification

This commit improves the security posture for Shadowrocket, Clash, and sing-box clients by implementing certificate fingerprint validation instead of the less secure certificate skipping approach.

Key changes:
- Shadowrocket: Replaced insecure TLS validation with HPKP-based certificate fingerprint verification
- Clash: Updated configuration to use certificate fingerprints instead of skip-cert-verify flags
- sing-box: Implemented certificate_public_key_sha256 verification for enhanced TLS security

This change ensures that only connections with verified server certificates are accepted, significantly reducing the risk of man-in-the-middle attacks while maintaining compatibility with self-signed certificates.

Dockerfile

@@ -1,11 +1,4 @@
-# 第一个阶段：使用 OpenSSL 生成证书文件
-FROM alpine/openssl:latest AS openssl
-
-# 生成私钥和证书
-RUN openssl ecparam -genkey -name prime256v1 -out /private.key && \
-    openssl req -new -x509 -days 36500 -key /private.key -out /cert.pem -subj "/CN=mozilla.org"
-
-# 第二个阶段：使用 Alpine 镜像并复制证书文件
+# 使用 Alpine 镜像
 FROM alpine:latest
 ARG TARGETARCH
 ENV ARCH=$TARGETARCH
@@ -13,14 +6,13 @@ ENV ARCH=$TARGETARCH
 # 设置工作目录
 WORKDIR /sing-box
 
-# 从第一个阶段的 OpenSSL 镜像中复制证书文件到当前镜像
-COPY --from=openssl /private.key /sing-box/cert/private.key
-COPY --from=openssl /cert.pem /sing-box/cert/cert.pem
+# 复制初始化脚本
 COPY docker_init.sh /sing-box/init.sh
 
+# 安装依赖并生成证书
 RUN set -ex &&\
-  apk add --no-cache supervisor wget nginx bash &&\
-  mkdir -p /sing-box/conf /sing-box/subscribe /sing-box/logs &&\
+  apk add --no-cache supervisor wget nginx bash openssl &&\
+  mkdir -p /sing-box/cert /sing-box/conf /sing-box/subscribe /sing-box/logs &&\
   chmod +x /sing-box/init.sh &&\
   rm -rf /var/cache/apk/*