packaging: UBI base image SHA pin in packaging.mk prevents dependabot from tracking security updates

### Context

The UBI10 micro `BASE_IMAGE` used for the Redhat ubi Docker image is pinned to a hardcoded SHA in `packaging.mk`: https://github.com/elastic/apm-server/blob/8.19/packaging.mk#L51

The problem with this approach is that it prevents `dependabot` from keeping this image up to date which would require us having to manually update the images as necessary.e.g: https://github.com/elastic/apm-server/pull/21747

### Goal
Move away from the `BASE_IMAGE` and make changes such that we can use dependabot to track and keep this image up to date.

Perhaps we can follow the same structure / pattern used by fips and wolfi.
https://github.com/elastic/apm-server/blob/8.19/packaging/docker/Dockerfile.fips

Start with packaging.mk at the BASE_IMAGE definition and compare the Redhat UBI packaging flow with packaging/docker/Dockerfile.fips, as suggested by the issue. Trace how the UBI image is selected and built, then verify that the resulting image reference can be tracked by Dependabot and that the packaging build still succeeds.

Written by the indexing model from the issue text.