feat(build): opt-in PKG_CACHE build arg for the internal package cache

Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile,
Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With
--build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go
through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/
Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and
stale-on-error. Without the arg the script is a no-op and builds are
unchanged.

- rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf
  fails over to the origin if the cache dies mid-build
- every RUN restores the original repo files before it ends, so no
  shipped layer carries the LAN address
- EPEL/Remi release RPMs come from the cache when it is set
- the php.net version gates are untouched

Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.shared-httpd

@@ -1,10 +1,19 @@
 FROM almalinux/10-base
 
+# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=http://192.168.1.40
+# (CT130 pkg-cache). Unset = upstream repositories exactly as before. Repo files
+# are restored at the end of every RUN, so no layer keeps the cache address.
+# See scripts/pkg-cache-repos.sh.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+
 # Install Apache and minimal dependencies (no PHP at all)
-RUN dnf install -y \
-      https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm && \
+RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
+    dnf install -y $(/usr/local/sbin/pkg-cache-repos.sh release-urls | cut -d' ' -f1) && \
+    /usr/local/sbin/pkg-cache-repos.sh rpm && \
     dnf update -y && \
     dnf install -y httpd mod_ssl openssl iproute cronie procps curl && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     dnf clean all && \
     rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*