Upgrade Debian base image from bookworm to trixie

What does this MR do?

Upgrades the CNG Debian base image from debian:bookworm-slim (Debian 12) to debian:trixie-slim (Debian 13). Trixie is now the current stable release and bookworm's regular security support ends in mid-2026.

Follow-up to #723 (closed) / !1616 (merged) (bullseye → bookworm).

Details

Debian 13 completed the 64-bit time_t transition, so several runtime library packages were renamed. Package names were verified against an actual debian:trixie-slim container:

From	To
libicu72	libicu76
libpng16-16	libpng16-16t64
libcurl3-gnutls	libcurl3t64-gnutls
libssl3	libssl3t64

Unchanged in trixie (verified): libtiff6, libturbojpeg0, libpcre2-posix3, libpcre2-16-0/32-0, zlib1g.

The distroless run images for gitlab-kas and gitlab-agentk are bumped from base-debian12 to base-debian13.

Verification

Verified locally against trixie:

• ✅ gitlab-base image builds
• ✅ kubectl image builds (exercises libssl3t64)
• ✅ gitlab-graphicsmagick dependencies script installs (exercises libpng16-16t64)
• ✅ gitaly and rails runtime package sets install cleanly
• ✅ base-debian13:nonroot exists for amd64 and arm64

Heavier images (rails/gitaly/ruby full builds and FIPS/UBI variants) rely on CI build args and are covered by the pipeline.

Closes #2374 (closed)