Do not rewrite Docker FROM images built from variables

[timtebeek]

Fixes #1211

What's changed

UpgradeDockerImageVersion built a ChangeFrom sub-recipe for every (image, oldVersion) pair — 170 of them when targeting Java 25.

DockerFrom's matcher substitutes a * for each environment variable and then matches bidirectionally, so for

ARG IMAGE_NAME
ARG IMAGE_TAG
FROM ${IMAGE_NAME}:${IMAGE_TAG}

the image name matched as matchesGlob("openjdk", "*") and the tag as matchesGlob("8*", "*"). The first ChangeFrom in the list therefore fired, the $1 capture resolved to nothing, and the reference was replaced with a hardcoded eclipse-temurin:25.

This replaces the sub-recipe list with a single visitor that:

• skips any FROM whose image name or tag contains a $, since the value can not be determined statically;
• parses the leading version from the tag and only bumps it when it sits between 8 and the target version, preserving the suffix (-jre-alpine, -jdk-jammy, ...);
• maps openjdk/adoptopenjdk to eclipse-temurin;
• drops any digest pin when it bumps the tag. The digest, not the tag, decides which image is pulled, so eclipse-temurin:25-jre@sha256:<openjdk-11-digest> would keep resolving to the pre-upgrade image.

As a side effect the recipe list of the aggregate migrations shrinks considerably: UpgradeToJava25 drops from 1398 to 488 recipes.

Tests

Added cases covering ${VAR} and $VAR in the image name, the tag, and both; a Dockerfile that mixes a variable FROM with a literal one; unrelated images; and digest pin removal. The existing parameterized cases are unchanged and still pass.