Dockerfile: do not let apt-get update errors slip through

When `apt-get update` fails to fetch from a repository due to a
transient network error, its default behavior is to issue a warning and
continue [^1]. When the git-core PPA is unavailable (which is currently
the case due to an ongoing DDoS incident), this causes `apt-get install`
to install an outdated version of `git` from the default Ubuntu
repositories.

To avoid this, let's set `--error-on=any` for `apt-get update`, which
causes it to error out on such transient network errors [^2]. This
option is available since Ubuntu 21.04 and is equivalent to the APT
option `APT::Update::Error-Mode=any` [^3].

See below how `--error-on=any` turns the warning into an error:

    linuxbrew@c557e2acccfe:~$ sudo apt-get update
    Hit:1 https://cli.github.com/packages stable InRelease
    Hit:2 http://archive.ubuntu.com/ubuntu jammy InRelease
    Hit:3 http://security.ubuntu.com/ubuntu jammy-security InRelease
    Hit:4 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
    Hit:5 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Err:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
      Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out
    Reading package lists... Done
    W: Failed to fetch https://ppa.launchpadcontent.net/git-core/ppa/ubuntu/dists/jammy/InRelease  Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out
    W: Some index files failed to download. They have been ignored, or old ones used instead.
    linuxbrew@c557e2acccfe:~$ sudo apt-get update --error-on=any
    Hit:1 https://cli.github.com/packages stable InRelease
    Hit:2 http://archive.ubuntu.com/ubuntu jammy InRelease
    Hit:3 http://security.ubuntu.com/ubuntu jammy-security InRelease
    Hit:4 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
    Hit:5 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Ign:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
    Err:6 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease
      Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out
    Reading package lists... Done
    E: Failed to fetch https://ppa.launchpadcontent.net/git-core/ppa/ubuntu/dists/jammy/InRelease  Could not connect to ppa.launchpadcontent.net:443 (185.125.190.80), connection timed out
    E: Some index files failed to download. They have been ignored, or old ones used instead.

[^1]: https://github.com/Debian/apt/blob/6b128124271e94bdb0f4e7850d9286170d712b04/apt-pkg/update.cc#L136-L139
[^2]: https://manpages.debian.org/trixie/apt/apt-get.8.en.html
[^3]: https://lists.ubuntu.com/archives/ubuntu-devel/2021-February/041374.html

Dockerfile

@@ -19,10 +19,10 @@ RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu
 # We need `[` instead of `[[` because the shell is `/bin/sh`.
 # shellcheck disable=SC1091,SC2154,SC2292
 RUN retry() { bash -c 'for i in {1..5}; do "$@" && exit 0; [[ $((i)) -lt 5 ]] && sleep $((i)); done; exit 1' -- "$@"; } \
-  && retry apt-get update \
+  && retry apt-get update --error-on=any \
   && apt-get install -y --no-install-recommends software-properties-common gnupg-agent \
   && if [ "$(uname -m)" != aarch64 ]; then retry add-apt-repository -y ppa:git-core/ppa; fi \
-  && apt-get update \
+  && retry apt-get update --error-on=any \
   && apt-get install -y --no-install-recommends \
   acl \
   bzip2 \