serving: mirror the remaining base/service images through Harbor

Route the pre-existing non-CI image pulls through harbor.bitasylum.org per the
standing rule (harbor.bitasylum.org/<registry>/<namespace>/<image>):
- enrol-broker/Dockerfile: golang:1.23-alpine -> dockerhub/library/...,
  smallstep/step-cli:latest -> dockerhub/smallstep/...
- dot1x-bench/docker-compose.yml: smallstep/step-ca + freeradius/freeradius-server
  -> dockerhub/<namespace>/...
CI-built git.bitasylum.org/audiobuzz/* images and ${OCI_IMAGE}/${IPXE_IMAGE}
type:image volume mounts are unchanged.

serving/dot1x-bench/docker-compose.yml

@@ -15,7 +15,7 @@
 services:
   # --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
   step-ca:
-    image: smallstep/step-ca:latest
+    image: harbor.bitasylum.org/dockerhub/smallstep/step-ca:latest
     network_mode: host
     restart: unless-stopped
     environment:
@@ -38,7 +38,7 @@ services:
 
   # --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
   freeradius:
-    image: freeradius/freeradius-server:latest
+    image: harbor.bitasylum.org/dockerhub/freeradius/freeradius-server:latest
     network_mode: host                    # RADIUS 1812/1813 from the authenticator
     restart: unless-stopped
     depends_on: