[actions] pull container images through Google's Docker Hub mirror

DockerHub's anonymous pull rate limit applies per IP for hours,
so retrying cannot ride it out on shared runners;
`mirror.gcr.io` serves the same official images without that limit,
as the io.js source-install job already does.

.github/workflows/tests-installation-node.yml

@@ -44,6 +44,7 @@ jobs:
             production.cloudfront.docker.com:443
             registry-1.docker.io:443
             auth.docker.io:443
+            mirror.gcr.io:443
       - uses: actions/checkout@v6
         id: checkout
         continue-on-error: true
@@ -65,9 +66,10 @@ jobs:
       - run: npx which urchin
       - name: Run installation_node tests in container
         run: |
-          # Retry the image pull to tolerate transient Docker registry failures
+          # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
+          # anonymous pull rate limits; retry to tolerate transient registry failures
           for i in 1 2 3 4 5; do
-            docker pull ubuntu:16.04 && break
+            docker pull mirror.gcr.io/library/ubuntu:16.04 && break
             echo "docker pull failed, attempt $i/5"
             sleep $((i * 5))
           done
@@ -79,7 +81,7 @@ jobs:
             -e "DEBIAN_FRONTEND=noninteractive" \
             -e "GITHUB_ACTIONS=true" \
             -e "WITHOUT_CURL=${{ matrix.without_curl }}" \
-            ubuntu:16.04 \
+            mirror.gcr.io/library/ubuntu:16.04 \
             bash -c '
               set -ex