Ensure dev-tools uses bookworm

In 1937177 ("dev-tools: use apt source for Node instead of setup script"),
I introduced the use of `Signed-By` with a public key block, which is only
supported in bookworm (bullseye only supports fingerprints, TTBOMK).

Python's Docker images already use bookworm by default, but we explicitly
require it now to avoid build errors if someone has a very old image laying
around (see, e.g., #3190).

(This can be dropped after Debian 13 ‘trixie’ is released.)

dev-tools/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.9
+FROM python:3.9-bookworm
 WORKDIR /app/dev-tools
 
 ENV PATH="/app/dev-tools/node_modules/.bin:$PATH"