Create the docker group with GID ensure a stable GID across all containers (#2703)

A security update hardened the host VM's Docker socket to 0660
(accessible only by the docker group). Because Buildkite runs your build
steps inside Docker containers under a custom user ID, Docker
automatically dropped the host's docker group membership from the
containerized processes, blocking them from accessing the socket and
causing build failures.

The Fix
To restore socket access inside the build containers without
compromising security:
VM Host Setup (setup-docker.sh): Pre-created the docker group on the GCE
host VM with a fixed, stable Group ID (GID 999).
CI Pipeline Config (bazelci.py): Added "additional-groups": ["999"] to
the Buildkite Docker plugin. This forces Docker to attach GID 999 to the
container process. Using a GID number instead of the group name "docker"
bypasses GID name-lookup issues inside base compiler images (like
Fedora).

Release Pipeline (pipelines/docker-update.yml): Applied the same
"additional-groups": ["999"] fix to prevent future automated release
pipeline failures.