refactor(portal): Use ghcr.io for public pulls of prod images (#3105)

Noticed our public pulls are coming from `pkg.dev` for prod, so this PR
fixes that so that they're from `ghcr.io` to avoid bandwidth fees and
segregate public pulls from our own infra pulls.

<img width="463" alt="Screenshot 2024-01-03 at 12 42 51 PM"
src="https://github.com/firezone/firezone/assets/167144/22f49996-fe6b-47c7-965f-23d14c9e4e59">

terraform/environments/production/main.tf

@@ -494,6 +494,11 @@ locals {
       name  = "AUTH_PROVIDER_ADAPTERS"
       value = "email,openid_connect,google_workspace,token"
     },
+    # Registry from which Docker install scripts pull from
+    {
+      name  = "DOCKER_REGISTRY"
+      value = "ghcr.io/firezone"
+    },
     # Telemetry
     {
       name  = "TELEMETRY_ENABLED"

terraform/environments/staging/main.tf

@@ -445,6 +445,11 @@ locals {
       name  = "AUTH_PROVIDER_ADAPTERS"
       value = "email,openid_connect,google_workspace,token"
     },
+    # Registry from which Docker install scripts pull from
+    {
+      name  = "DOCKER_REGISTRY"
+      value = "${module.google-artifact-registry.url}/${module.google-artifact-registry.repo}"
+    },
     # Telemetry
     {
       name  = "TELEMETRY_ENABLED"

terraform/modules/elixir-app/main.tf

@@ -39,10 +39,6 @@ locals {
       name  = "PLATFORM_ADAPTER"
       value = "Elixir.Domain.GoogleCloudPlatform"
     },
-    {
-      name  = "DOCKER_REGISTRY"
-      value = "${var.container_registry}/${var.image_repo}"
-    },
     {
       name = "PLATFORM_ADAPTER_CONFIG"
       value = jsonencode({