lock container image versions for testing and setup system for upgrading

We use Docker containers to run a number of services for testing module instrumentations. E.g. mssql for tedious instrumentation, postgres for pg instrumentation, etc. *Some* of those container images are specified to be a particular version -- typically when there was some issue with the latest version -- but for some we don't specify a docker tag, hence defaulting to "latest". I think we should:

1. Lock the used container images to a specific version for test repeatability.
2. Discuss and decide if we want to specify a complete version (e.g. "mysql:1.2.3") or just a major version (e.g. "mongo:5", if the particular image provides docker tags for the major version). The trade-off is a repeatable test run vs. only noticing breakage due to a minor or patch-level container image release when (rarely) updating to the latest container version.
3. Setup a system for regularly updating Docker image versions.

# Details

Regarding (3.), how to regularly update Docker image versions. I'd have hoped to use dependabot for this, but I believe it is not supported (https://github.com/dependabot/dependabot-core/issues/390). Therefore we'd need to use some other tool. One possibility would be the "dev-utils/bitrot.js" tool I'm working on in https://github.com/elastic/apm-agent-nodejs/pull/2924. Of course that won't have near the nice integration and automation that dependabot support might provide.

Unfortunately, our test docker image versions are replicated in three different files, so even with dependabot support it might result in triplicate PRs, which would be noisy.
```
.ci/docker/docker-compose.yml
.github/workflows/test.yml
test/docker-compose.yml
```

Regarding (2.), whether to use a complete version or just a major version. I don't have a *strong* opinion, but my inclination is to specify a major version because hopefully this should be less maintenance. Especially given that we can't use dependabot automation for this, the less maintenance the better. Locking to a major version would have prevented [this breakage due to mongo image version 6](https://github.com/elastic/apm-agent-nodejs/pull/2936) but *not* [this breakage due to cassandra:3.11.11](https://github.com/elastic/apm-agent-nodejs/pull/2678).