prepare 2.3.3 release

[cspath1]

Releases two changes that have been sitting on main:

#253 retry rate-limited flag requests, and preserve cancellation and
timeout errors while reading flag responses
#255 pelletier/go-toml/v2 to v2.4.3 (XRAY-1033007)

Patch rather than minor: #253 is retry and error-propagation behaviour, which the contributor filed under Fixed, and no inputs or outputs changed.

Two corrections to repository bookkeeping while here:

The version constant was still 2.3.1. v2.3.2 was tagged directly at the #254 merge commit without a prepare-release commit, so the constant and the metadata pins never moved. Both are now at 2.3.3.

The changelog had no 2.3.2 entry for the same reason, even though v2.3.2 was a real release that Gonfalon pins. Backfilled it from #254.

Also floats the docker/ entry point example on @v2 to match the two root Action examples above it, which already used @v2. That line no longer needs rewriting each release, and the "pin to a release that includes the docker/ entry point" caveat is obsolete now it floats. The dockerImage input keeps an exact tag.

---

Note

Overview
Prepares the 2.3.3 release by aligning repo metadata with changes already on main, without altering action inputs or outputs in this diff.

CHANGELOG.md adds a 2.3.3 Fixed section (rate-limit retries, preserving cancel/timeout errors on flag reads, go-toml/v2 bump for XRAY-1033007) and backfills 2.3.2 (Go 1.26.8 toolchain and dependency/image pins) after v2.3.2 was tagged without a prepare-release commit.

internal/version/version.go updates the version constant from 2.3.1 to 2.3.3. docker/action.yml default and example dockerImage tags move from 2.3.1 to 2.3.3.

README.md switches the docker entry-point example from a pinned @v2.3.1 to @v2 (matching root action examples) while keeping the mirrored-image example on tag 2.3.3.

^{Reviewed by Cursor Bugbot for commit 4fce911. Bugbot is set up for automated code reviews on this repo. Configure here.}