Switch to Debian bookworm + sury PHP 7.4 for security fixes

The official php:7.4-apache image is frozen at 7.4.33 (Nov 2022) on
Debian 11. deb.sury.org still ships patched 7.4 builds, including the
fix for CVE-2026-109618/109619. Moodle and PHP version stay the same.

Also replace the Moosh zip download (404 on moodle.org) with a build of
the same 1.25 release from GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apache-php.conf

@@ -0,0 +1,11 @@
+<FilesMatch \.php$>
+	SetHandler application/x-httpd-php
+</FilesMatch>
+
+DirectoryIndex disabled
+DirectoryIndex index.php index.html
+
+<Directory /var/www/>
+	Options -Indexes
+	AllowOverride All
+</Directory>