docs: add legacy notice to Dockerfile

Multi-model code review confirmed that Ubuntu Trusty's pip 1.5.4 does
not support --require-hashes, making the Dockerfile non-buildable. Since
it was already non-functional (bintray.com shut down 2021, Python 2 and
Ruby 2.4.1 are EOL), add an explicit comment documenting this status.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Zack Koppert <zkoppert@github.com>

Author: zkoppert

Dockerfile

@@ -1,3 +1,7 @@
+# NOTE: This Dockerfile is legacy and non-functional. It references Ubuntu Trusty
+# (14.04, EOL 2019), Python 2, Ruby 2.4.1, and bintray.com (shut down 2021).
+# CI uses GitHub Actions directly (see .github/workflows/ci.yml).
+# Changes below maintain code scanning compliance only.
 FROM ubuntu@sha256:64483f3496c1373bfd55348e88694d1c4d0c9b660dee6bfef5e12f43b9933b30 # trusty
 
 RUN apt-get update -qq