The upstream woodpeckerci/plugin-docker-buildx image does not trust the
internal CA, so pushes/pulls against artifactapi over TLS fail. Swap both
the PR dry-run build step and the tag push step to the CA-baked custom
image published at docker-internal/plugin-docker-buildx:latest.