Fully qualify container image URLs

Dockerfile

-FROM node:current-bullseye AS assets
+FROM docker.io/library/node:current-bullseye AS assets
 ADD . /src
 WORKDIR /src
 RUN npm install && env NODE_OPTIONS=--openssl-legacy-provider ./node_modules/.bin/webpack
 
 # Debian bullseye can't build gostatic due to its strict dependency
 # on Go >1.17, so we build it separately.
-FROM golang:1.19 AS gobuild
+FROM docker.io/library/golang:1.19 AS gobuild
 RUN go install github.com/piranha/gostatic@latest
 RUN go install git.autistici.org/ai/webtools/cmd/jsonsubst@latest
 RUN go install git.autistici.org/ai/webtools/cmd/sitesearch@latest
 
-FROM debian:bullseye-slim AS build
+FROM docker.io/library/debian:bookworm-slim AS build
 ADD . /src
 WORKDIR /src
 COPY --from=gobuild /go/bin/gostatic /usr/bin/gostatic
@@ -19,7 +19,7 @@ COPY --from=gobuild /go/bin/jsonsubst /usr/bin/jsonsubst
 COPY --from=assets /src/assets/templates/ /src/assets/templates/
 RUN ./scripts/lint.sh && ./scripts/update.sh
 
-FROM debian:bullseye-slim AS precompress
+FROM docker.io/library/debian:bookworm-slim AS precompress
 RUN apt-get -q update && env DEBIAN_FRONTEND=noninteractive apt-get -qy install brotli
 COPY --from=build /src/public /var/www/autistici.org
 COPY --from=assets /src/assets/static/ /var/www/autistici.org/static/