False positive on CKV_DOCKER_7 when base image is a build ARG with a pinned default tag

Describe the issue CKV_DOCKER_7 ("Ensure the base image uses a non latest version tag") flags a FROM ${ARG} instruction as using the latest tag, even though the ARG used in the FROM line has a default value that pins a specific, non-latest version. Checkov appears to treat any FROM ${VAR} as unresolved/latest, rather than resolving the referenced ARG's default value declared earlier in the same Dockerfile.

Examples

# Dockerfile
ARG BASE_IMAGE=python:3.11.9-slim

FROM ${BASE_IMAGE} AS build

RUN pip install --no-cache-dir requests

Expected behavior Checkov should resolve ${BASE_IMAGE} to its declared default (python:3.11.9-slim), see that it is pinned to a specific version, and pass the check (no finding).

Actual behavior Checkov reports a finding on the FROM ${BASE_IMAGE} line, treating it as if it used the latest tag:

Check: CKV_DOCKER_7: "Ensure the base image uses a non-latest version tag"
    FAILED for resource: /Dockerfile.FROM
    File: /Dockerfile: 3-3
    Guideline: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-the-base-image-uses-a-non-latest-version-tag

        3 | FROM ${BASE_IMAGE} AS build

Version (please complete the following information):

• Checkov Docker Image Version: bridgecrew/checkov:3.3.15

Additional context This pattern (declaring ARG BASE_IMAGE=<pinned-tag> before FROM ${BASE_IMAGE}) is a common and recommended way to make the base image configurable at build time (e.g. via --build-arg) while still defaulting to a pinned, auditable tag. Since the default value is statically declared in the same file, it should be possible for the parser to resolve it back to a concrete image reference and evaluate the tag correctly.