chore(deps): update ghcr.io/zitadel/zitadel docker tag to v4.19.5

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/zitadel/zitadel	patch	v4.19.4 → v4.19.5

---

Release Notes

zitadel/zitadel (ghcr.io/zitadel/zitadel)

v4.19.5

Compare Source

⚠️ Upgrade notes

• Device authorization: users now confirm the device on a consent screen. If a project requires a grant to authenticate, users without one can no longer sign in through the device flow. Custom login UIs need the session.read permission for GetDeviceAuthorizationRequest.
• Login V2: email and invite verification, passkey registration and IdP linking are now also protected by ZITADEL_SESSION_COOKIE_SECRET. If you use a value from an example configuration (e.g. SessionCookieSecretNeedsAtLeast32Chars from the compose .env.example), replace it with a random one. Users in the middle of one of these steps during the upgrade have to repeat it.
• List limits: list endpoints now enforce the default and maximum query limits (A10018).

Bug Fixes

• api: enforce query limits on v2 list endpoints (#​12875) (247d8ce), closes zitadel/zitadel#12881 zitadel/zitadel#12876
• api: restore query limits on v1 list endpoints (#​12876) (fe4f4fd), closes zitadel/zitadel#12875 #​2342 #​2433 #​2383 #​2612 #​2820 #​2818 #​2838 #​3075 #​3096 zitadel/zitadel#12881 zitadel/zitadel#12875
• console: don't load all projects on startup and prepare for list limits (#​12881) (95dae90), closes zitadel/zitadel#12875 zitadel/zitadel#12876 #​12875 #​12875 #​12876 #​12876
• login: sign user verification check and IdP link proof with server secret (e32ba7a)
• reject invalid public host headers instead of ignoring them (6493aa9)
• require consent and authorization to approve device authorizations (a618740)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 6am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.