Migrate base container images away from Docker Hub

### Code improvement description

A lot of our base container images use images from [Docker Hub][1]. Unfortunately, Docker Hub has quite restrictive rate limits[^1] and we frequently hit them when running tests[^2].

Copying the base images that we rely on, on a regular basis, into a container registry that we have more control of, like [GitHub Container Registry][2] or an [Azure Container Registry][3] instance, would prevent flaky test failures due to rate limits.

There are two main concerns I have about an approach like this:
- Currently we rely a lot on mutable container tags and implicitly get updates i.e. `python:3.9` is mutable. If we start copying images into our own registry, we'd have to take care to stay on top of any updates to tags we rely on
- Do the licenses of the container images allow for us to copy them to our own registry?

An alternative to this would be to use something like [`docker/login-action`][4] to authenticate with Docker Hub and get a higher rate limit. But that requires us to manage credentials.

[^1]: https://docs.docker.com/docker-hub/download-rate-limit/
[^2]: https://github.com/dependabot/dependabot-core/pull/9042#issuecomment-1942050753

[1]: https://hub.docker.com
[2]: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
[3]: https://azure.microsoft.com/en-us/products/container-registry
[4]: https://github.com/docker/login-action

Start by reviewing the CI test setup and the base-image references that currently pull from Docker Hub; the issue does not name files or entry points. Compare copying images to GitHub Container Registry or Azure Container Registry with using docker/login-action, including tag updates, credentials, and license constraints. Done requires an agreed, maintainable approach with the required image-update process documented.

Written by the indexing model from the issue text.