Use mirrored Docker Hub images to avoid rate limits

Mirror base images to our GitLab registry to avoid Docker Hub's
unauthenticated pull rate limits (100 pulls/6 hours per IP).