ci: pin .NET SDK image to 9.0 to match global.json

The pinned jellyfin-ha-src fork sets global.json sdk 9.0.0 (rollForward
latestMinor), so the publish steps in build.yaml and docker.yaml must run
on the .NET 9 SDK. They referenced sdk:10.0, which fails the pinned build.
Repoint both publish steps to mcr.microsoft.com/dotnet/sdk:9.0.

.woodpecker/docker.yaml

@@ -5,7 +5,7 @@ when:
 steps:
   # Same publish step as the PR pipeline: clone pinned upstream + dotnet publish.
   - name: publish
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: mcr.microsoft.com/dotnet/sdk:9.0
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)