[9.5](backport #7782) fix: bypass expired Debian 11 security repo in Dockerfile.build

[mergify]

⚠️ TEMPORARY WORKAROUND — Revert once elastic/golang-crossbuild#754 is merged and new images are published

What is the problem this PR solves?

The Buildkite Package x86_64 and Package aarch64 jobs are failing (e.g. build #16689) because Debian 11 (Bullseye) reached EOL and its security repository's InRelease file has expired. apt-get update in Dockerfile.build fails with:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired

The root cause fix is in the upstream base image: elastic/golang-crossbuild#754, which switches Debian 11 sources to the archive and snapshot mirrors. This PR should be reverted once that PR is merged and new golang-crossbuild images are published.

How does this PR solve the problem?

Passes -o Acquire::Check-Valid-Until=false to apt-get update in Dockerfile.build to bypass the expiry check. This does not change the Debian version being built for — the base image remains golang-crossbuild:*-debian11. Since Debian 11 is EOL, the security repo has no new updates regardless, so bypassing the validity check has no practical security impact.

How to test this PR locally

Trigger a packaging build or run locally:

docker build -t fleet-server-builder:test --build-arg GO_VERSION=$(cat .go-version) --build-arg SUFFIX=main-debian11 -f Dockerfile.build .

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have commented my code, particularly in hard-to-understand areas

Related issues

• Relates to: fix: Debian 11 EOL sources and apt sources/packages on Debian 12 golang-crossbuild#754 (root cause fix — revert this PR once that lands)

  ---

  This is an automatic backport of pull request fix: bypass expired Debian 11 security repo in Dockerfile.build #7782 done by Mergify.

[ycombinator]

Closing unmerged as main PR was no longer needed: #7782 (comment)