ci: use at least a pinned major debian version, so we do not get caugt by silnet major version changes (#5290)

Co-authored-by: Darragh Elliott <me@delliott.net>
Reviewed-on: #5290

build.Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:latest
+FROM debian:13
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 

pre-commit.Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:latest
+FROM debian:13
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/