nats: run 2.11.17, which hands a consumer with several filters every message (hq issue 266)

On 2.10.29 such a consumer was moved past a message now and then without
handing it over; the controller's events consumer has seven filters, and a
merge on the stream never reached it. The test reproduces the skip on 2.10.29
and keeps the image's release equal to the server it tests.

modules/nats/Dockerfile

@@ -7,6 +7,15 @@
 # that names a manifest rather than the mistake. This is the index — `docker pull` reports the same
 # one, and `RepoDigests` confirms it.
 #
+# **The release the digest is, said here because a digest does not say it:**
+#
+# upstream: nats 2.11.17-alpine
+#
+# Kept equal to the server version cmd/nats-tools tests against (its go.mod), and a test there fails
+# when they differ: that test is what says the server delivers every message to a consumer with
+# several filters. 2.10.29 did not — it moved such a consumer past a message now and then without
+# handing it over, and the controller never heard of a merge (novox/hq issue 266).
+#
 # Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
 # the module's code is the server, which upstream already built. There is no BUILD_BASE here on
 # purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and