serving: mirror the remaining base/service images through Harbor

Route the pre-existing non-CI image pulls through harbor.bitasylum.org per the
standing rule (harbor.bitasylum.org/<registry>/<namespace>/<image>):
- enrol-broker/Dockerfile: golang:1.23-alpine -> dockerhub/library/...,
  smallstep/step-cli:latest -> dockerhub/smallstep/...
- dot1x-bench/docker-compose.yml: smallstep/step-ca + freeradius/freeradius-server
  -> dockerhub/<namespace>/...
CI-built git.bitasylum.org/audiobuzz/* images and ${OCI_IMAGE}/${IPXE_IMAGE}
type:image volume mounts are unchanged.

serving/enrol-broker/Dockerfile

@@ -7,14 +7,14 @@
 #
 # Pin + mirror these base tags through your registry (like the rest of the stack)
 # if the build/serving host has no egress.
-FROM golang:1.23-alpine AS build
+FROM harbor.bitasylum.org/dockerhub/library/golang:1.23-alpine AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go wordlist.txt ./
 ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local
 RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker .
 
-FROM smallstep/step-cli:latest
+FROM harbor.bitasylum.org/dockerhub/smallstep/step-cli:latest
 COPY --from=build /enrol-broker /usr/local/bin/enrol-broker
 # Non-root by default (the step-cli image runs as uid 1000 "step"); the broker
 # binds loopback ports >1024 and only READS the mounted CA root + provisioner