Import and gate images that are used for pre-built images

[Chuxel]

Currently our CI system builds images as you would expect: pulling from MCR DockerHub at time of build. Unfortunately this has two side effects.

1. If there's an outage for DockerHub (which to date has been very rare), we won't be able to publish image updates. (MCR contains the actual resulting image, which decouples its use from DockerHub).
2. If for some reason the image in use is unpublished, removed, or corrupted, we aren't able to publish image updates (potentially in the long run if the image is complettely abandoned).

To mitigate these risks, we can automatically import images into a secondary private image repository and use that during CI builds. However, we need to ensure each base.Dockerfile can be built from DockerHub as well for end-users that opt to build their own images from scratch. So, this will require build system modifications to achieve.