Fix and harden the LuaRocks publish pipeline

[whiteh]

Fix and harden the LuaRocks publish pipeline

Fixes the publish-luarocks workflow, which failed on first real use, and adds guardrails to stop bad rockspecs reaching master.

Changes

• Install luarocks in the publish workflow — the OpenResty apt package doesn't ship it, only the Docker image builds one in image; lint/make/upload all need it on PATH.
• Install dkjson for luarocks itself — luarocks upload needs a JSON library available to its own Lua environment, separate from the project's lua-cjson runtime dependency (which only lands in the throwaway test tree).
• Add check_rockspec_version.sh, wired into the PR/push build workflow, which fails the build if:
  • the rockspec filename and its internal version = "..." field disagree, or
  • the corresponding vX.Y.Z git tag already exists (catches an unbumped version before merge, not after release).
• Loosen the rockspec COPY in Dockerfile and Dockerfile.nginx_lua to *.rockspec instead of a hardcoded filename, so bumping the version no longer requires touching either Dockerfile. Updated CONTRIBUTING.md to drop that now-unnecessary step.

Testing

• Verified end-to-end against a real tag: publish_to_luarocks.sh successfully lints, pins the source tag, and uploads to luarocks.org.
• Verified check_rockspec_version.sh correctly rejects an already-tagged version (tested against v1.6.2, then cleaned up).