Dockerfile: fully-qualify base image (buildah short-name TTY fix)

buildah (quay.io/buildah/stable) enforces short-name resolution and cannot
prompt without a TTY, so 'FROM woodpeckerci/plugin-docker-buildx:latest' errors.
Qualify as docker.io/... . Keep it on docker.io (public CA) deliberately: this
image is what bootstraps internal-CA trust, so pulling its own base through the
internal-CA artifactapi registry would reintroduce the x509 problem in-build.

Dockerfile

@@ -1,4 +1,4 @@
-FROM woodpeckerci/plugin-docker-buildx:latest
+FROM docker.io/woodpeckerci/plugin-docker-buildx:latest
 # buildkit reads this to trust artifactapi's internal-CA registry on push
 COPY unkin-ca.crt /etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt
 # fallback: system trust store (docker login / other code paths)