Fix autofix Docker build on GitHub runners (#1980)

The `autofix` job fails on every PR and on master because apt cannot
install packages in the bullseye images.
Debian 11 reached end of life on 2026-08-31, and its packages are moving
from deb.debian.org to archive.debian.org.
The php-cs-fixer image now installs `git` and `unzip` from
archive.debian.org when the base image is bullseye.

<details>
<summary>deb.debian.org still serves the bullseye package lists, but not
the security packages</summary>

`apt-get update` succeeds, then `apt-get install` fails with `404 Not
Found` for packages in `bullseye-security`.
archive.debian.org serves `bullseye` main, but not `bullseye-security`
yet.
Last passing run:
https://github.com/webonyx/graphql-php/actions/runs/33423045262.
First failing run:
https://github.com/webonyx/graphql-php/actions/runs/34238445855.
Log with the 404s:
https://github.com/webonyx/graphql-php/actions/runs/36310173564.
</details>

<details>
<summary>Installing the dependencies in the composer image would avoid
apt, but is a bigger change</summary>

`composer require` could run in the `composer` stage, which already has
`git` and `unzip`, with `platform.php` set to the target PHP version.
That needs a PHP version build argument in the Makefile.
For a throwaway formatter image, frozen packages without security
updates are acceptable.
</details>

🤖 Generated with Claude Code

Author: spawnia

.php-cs-fixer.dockerfile

@@ -1,7 +1,11 @@
 ARG IMAGE
 FROM ${IMAGE}
 
-RUN apt-get update \
+# Debian 11 reached end of life and moved to archive.debian.org
+RUN if grep -q VERSION_CODENAME=bullseye /etc/os-release; then \
+    echo "deb http://archive.debian.org/debian bullseye main" > /etc/apt/sources.list; \
+  fi \
+  && apt-get update \
   && apt-get install --yes --no-install-recommends \
     git \
     unzip \