ci: use CA-baked plugin-docker-buildx image for artifactapi push

The upstream woodpeckerci/plugin-docker-buildx image does not trust the
internal CA, so buildx pushes to artifactapi fail on TLS verification.
Swap it for the CA-baked custom image published in the docker-internal
repo, in both the tag push (docker.yaml) and PR dry-run (build.yaml)
steps.

.woodpecker/build.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: docker-build
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api
       dry_run: true

.woodpecker/docker.yaml

@@ -4,7 +4,7 @@ when:
 
 steps:
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api