Avoid pinning docker image hash in bazel-testing org (#2784)

In the `bazel-testing` Buildkite org, newly built test images are pushed
to `gcr.io/bazel-public/testing/` without updating the pinned production
hashes in `IMAGE_HASHES`.

This change ensures that jobs running in `bazel-testing` resolve Docker
image tags dynamically from the testing registry prefix rather than
requiring a pinned SHA256 digest.

buildkite/bazelci.py

diff --git a/buildkite/bazelci.py b/buildkite/bazelci.py
index d6cfc04..804eb98 100755
--- a/buildkite/bazelci.py
+++ b/buildkite/bazelci.py
@@ -318,6 +318,8 @@
 
 
 def get_docker_image(image_name):
+    if THIS_IS_TESTING:
+        return f"gcr.io/{DOCKER_REGISTRY_PREFIX}/{image_name}"
     digest = IMAGE_HASHES.get(image_name)
     if not digest:
         raise ValueError(f"No digest found for docker image: {image_name}")