DL3020: Use COPY instead of ADD for files and folders

ADD has implicit behaviors that COPY does not: it auto-extracts archives and can fetch remote URLs. This unpredictability is a security concern because ADD from a URL fetches content without checksum verification, and auto-extraction can unpack unexpected content. Use COPY for straightforward file copies and explicit commands (curl/wget + tar) when you need archives or remote resources.