Don't pull images from docker hub to build Salsa CI images

The image build jobs currently fetch (with buildah) the debian containers from docker.io. But that is not really necessary, and it has issues like:

1. rate limitations

STEP 1/24: FROM docker.io/library/debian:bookworm
Trying to pull docker.io/library/debian:bookworm...
time="2025-06-15T17:52:43Z" level=warning msg="Failed, retrying in 1s ... (1/3). Error: initializing source docker://debian:bookworm: reading manifest bookworm in docker.io/library/debian: toomanyrequests: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit"
time="2025-06-15T17:53:15Z" level=warning msg="Failed, retrying in 2s ... (2/3). Error: initializing source docker://debian:bookworm: reading manifest bookworm in docker.io/library/debian: toomanyrequests: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit"
time="2025-06-15T17:53:48Z" level=warning msg="Failed, retrying in 4s ... (3/3). Error: initializing source docker://debian:bookworm: reading manifest bookworm in docker.io/library/debian: toomanyrequests: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit"
Error: creating build container: initializing source docker://debian:bookworm: reading manifest bookworm in docker.io/library/debian: toomanyrequests: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit

From: https://salsa.debian.org/santiago/pipeline/-/jobs/7712619

2. access limitations from China (/cc @vimerbf-guest), which make it difficult to use the China-based runners.

We could create the open container images directly from scratch, using mmdebstrap probably.