RELOPS-2353: Stabilize Ubuntu Kitchen apt bootstrap

[jwmossmoz]

Summary

• replace kitchen-docker's autogenerated Ubuntu bootstrap Dockerfile with a repo-owned ERB template
• configure apt retries/timeouts before the first apt update and install bootstrap packages in the same layer
• prefer azure.archive.ubuntu.com on GitHub-hosted runners, rewrite archive/security sources together, and fall back through the Ubuntu mirror list
• install Kitchen's expected bootstrap/runtime packages, including systemd and ca-certificates, before run_command: /bin/systemd
• keep bootstrap apt package behavior aligned with kitchen-docker's default apt-get install -y behavior so recommended runtime packages like systemd-timesyncd are present on noble
• remove the later provision_command apt bootstrap that ran too late to fix Kitchen create failures

Jira

• https://mozilla-hub.atlassian.net/browse/RELOPS-2353

Validation

• ruby -e 'require "yaml"; YAML.load_file(".kitchen_configs/kitchen.docker.yml")'
• git diff --check
• rendered .kitchen_configs/Dockerfile.ubuntu.erb with kitchen-docker's default ERB.new mode
• Docker builds from the rendered template passed for ubuntu:18.04, ubuntu:22.04, and ubuntu:24.04 on linux/amd64
• verified the rendered test images contain /bin/systemd, /usr/sbin/sshd, /usr/bin/curl, /etc/ssl/certs/ca-certificates.crt, and the expected distro codename for bionic, jammy, and noble
• verified curl -fsSL can fetch the configured puppet_omnibus_url from each rendered test image
• verified the rendered noble image includes systemd-timesyncd; local systemctl start systemd-timesyncd returns success under /bin/systemd
• GitHub Linux checks passed on commit 1842545f in run https://github.com/mozilla-platform-ops/ronin_puppet/actions/runs/25340982416

[aerickson]

thanks!