fix: GPG key import via temp file instead of pipe to function

Issue:
- OpenTofu GPG import still failing with NO_PUBKEY error
- Piping curl output to run_privileged function doesn't preserve stdin
- The pipe syntax looked correct but wasn't actually connecting the streams

Root cause:
- Bash functions don't automatically forward stdin from pipes
- curl | run_privileged gpg executed as TWO separate commands
- gpg --dearmor received no input, created empty file

Fix:
- Download GPG keys to temp files first: curl -o /tmp/key.gpg
- Then dearmor from file: gpg --dearmor -o /etc/apt/keyrings/key.gpg /tmp/key.gpg
- Clean up temp file after
- Applied to both Docker and OpenTofu GPG key imports

Why this works:
- File-based approach avoids pipe-to-function stdin issues
- gpg can read from file argument directly
- More explicit and debuggable

Result:
- ✅ GPG keys will be properly dearmored
- ✅ apt can verify repository signatures
- ✅ Docker and OpenTofu installations will succeed