Switch to Debian bookworm + sury PHP 7.4 for security fixes

The official php:7.4-apache image is frozen at 7.4.33 (Nov 2022) on
Debian 11. deb.sury.org still ships patched 7.4 builds, including the
fix for CVE-2026-109618/109619. Moodle and PHP version stay the same.

Also replace the Moosh zip download (404 on moodle.org) with a build of
the same 1.25 release from GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start.sh

@@ -3,4 +3,6 @@
 service cron start
 
 # Start Apache in foreground
-apache2-foreground
+. /etc/apache2/envvars
+rm -f "$APACHE_PID_FILE"
+exec apache2 -DFOREGROUND