CI: Switch to the NVIDIA internal Ubuntu mirror (#1961)

## What?

Rewrite the apt sources in the **CI-only** Dockerfiles under
`.ci/dockerfiles/` to pull from the NVIDIA internal Ubuntu mirror
instead of the public repo:

- `Dockerfile.base`
- `Dockerfile.build_helper`
- `Dockerfile.gpu-test`
- `Dockerfile.sglang-base`
- `Dockerfile.vllm-base`

## Why?

`ports.ubuntu.com` (the arm64 mirror) went unreachable during the
2026-07 Canonical outage, breaking every aarch64 image build. The
internal mirror is always reachable from the runners.

## How?

One `sed` before each first `apt-get` rewrites the sources host to
`ubuntu-public` - a virtual repo that merges the amd64 archive and arm64
ports remotes, so a single base URL serves both arches (verified:
`binary-amd64` and `binary-arm64` both resolve). Suite-preserving,
covers classic `sources.list` + deb822. A urm TLS verify-skip lets bare
ubuntu bases (no ca-certificates) use the https mirror. Customer-facing
`contrib/` Dockerfiles stay on the public mirrors.

Repo path verified against the Artifactory API; regex verified locally
against classic + deb822 + ports/arm64. Draft pending a `/build`.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Build and Infrastructure**
* Improved container image build reliability by switching Ubuntu package
installs to use a controlled internal APT mirror.
* Added optional `APT_MIRROR` support to container builds, allowing
package sources to be overridden at build time.
* Updated build tooling and CI build matrices to consistently pass and
apply `APT_MIRROR` across image build steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->