ci: pre-pull Testcontainers images in worker before unit tests (#19464)

[Shekharrajak]

Fixes #19464.

Description

Once the image is in the runner's local Docker daemon cache, KafkaContainer start in KafkaResource becomes a pure container-spinup (~5-15 s) instead of pull+spinup (~30-90 s + Docker Hub variance). The 60 s LatchableEmitter wall now has 4-12× more headroom.

Fixed the bug ...

Renamed the class ...

Added a forbidden-apis entry ...

Release note

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.

[jtuglu1]

Can we do this for the other container images as well? e.g. ZK, metadata DB

[Shekharrajak]

Checking,
looks like ZK is JVM based in test and metadata DB is postgres. But I have other list:

apache/kafka:4.2.0
            postgres:16-alpine
            minio/minio:latest
            hashicorp/consul:1.18
            tabulario/iceberg-rest:1.6.0
            localstack/localstack:4.13.1
            mcr.microsoft.com/azure-storage/azurite:3.35.0
            osixia/openldap:1.5.0
            rancher/k3s:v1.35.0-k3s1

[FrankChen021]

I have reviewed the code for correctness, edge cases, concurrency, and integration risks; no issues found.

Reviewed 1 of 1 changed files.

---

This is an automated review by Codex GPT-5.5