move docker image back to node 18 / buster

[paulfitz]

This partially undos a recent upgrade because it results in gvisor sandboxing not functioning. Hopefully this is temporary, to give time to track down the cause, fix it, and extend CI testing on candidate docker images to include gvisor sandboxing.

Upgrade: #1255

Sorry for the breakage! Workarounds until this lands and takes effect: use the gristlabs/grist:stable image, or set GRIST_SANDBOX_FLAVOR to pyodide.

Tested manually with:

docker build -t candidate .
mkdir -p /tmp/candidate
docker run -e GRIST_SANDBOX_FLAVOR=gvisor -v /tmp/candidate:/persist \
  --name /grist --rm -p 8484:8484 -it candidate

and checking whether formulas work, before and after the change.