feat(images): add apt_sources_mirror() chainable method for Debian builds

[Goutham-Annem]

Summary

Adds a new chainable apt_sources_mirror(url: str) method to the Image builder class (closes #5374).

• Users in regions with slow Debian mirrors can now call .apt_sources_mirror("https://...") on their image to swap the default http://deb.debian.org/debian URL before any apt-get invocation.
• The implementation inserts a sed command that tries the Debian 12+ debian.sources file first, then falls back to the legacy sources.list, so it works across Debian releases without any extra configuration.
• Two unit tests are added in tests/unit/_bentoml_sdk/test_images.py to verify the generated command and that the method returns self for chaining.

Usage example:

from _bentoml_sdk.images import Image

image = (
    Image("debian:latest")
    .apt_sources_mirror("https://mirrors.tuna.tsinghua.edu.cn/debian")
    .system_packages("curl", "git")
)

Test plan

• pytest tests/unit/_bentoml_sdk/test_images.py — all three tests pass (existing + two new ones).
• Manually verify the generated Dockerfile contains the sed line before apt-get install.

Note: This PR was developed with AI assistance (Claude Code).

[Goutham-Annem]

Hi — the Veracode SCA and Static Analysis failures appear to be pre-existing and unrelated to this PR's changes (they fire on all recent PRs). Could a maintainer confirm whether these are expected to pass before merge, or if they can be waived? Happy to address any actual code feedback!