fix(enterprise): use apt-get install --only-upgrade for targeted package updates

apt-get upgrade does not accept package arguments - it upgrades all packages.
Changed to apt-get install --only-upgrade to correctly target specific
packages for security updates (GnuPG CVEs).

Co-authored-by: openhands <openhands@all-hands.dev>

enterprise/Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && \
     apt-get install -y nodejs && \
     apt-get install -y jq gettext && \
     # Apply security updates for packages with available fixes
-    apt-get upgrade -y \
+    apt-get install --only-upgrade -y \
         libc-bin \
         libc6 \
         libgnutls30 \