Have every suite compose file name the caller's test image

Only the static family read FIPS_TEST_IMAGE; the firewall, ACL, nat,
sidecar and both Tor compose files named the shared mutable tag directly,
which is why the local CI runner has to retag its per-run image to that
name. They now take the same defaulted form the static file already uses,
so a harness run resolves the image it built and a bare hand run still
resolves the shared tag exactly as before.

Checked by rendering each file through `docker compose config` with the
variables set: every service resolves to the supplied name and none is
left naming the shared tag.

testing/sidecar/docker-compose.yml

@@ -14,7 +14,7 @@ networks:
 
 services:
   fips:
-    image: fips-test:latest
+    image: ${FIPS_TEST_IMAGE:-fips-test:latest}
     hostname: fips-sidecar
     labels:
       - "com.corganlabs.fips-ci=1"
@@ -40,7 +40,7 @@ services:
         ipv4_address: ${FIPS_IPV4:-172.20.1.20}
 
   app:
-    image: fips-test-app:latest
+    image: ${FIPS_TEST_APP_IMAGE:-fips-test-app:latest}
     labels:
       - "com.corganlabs.fips-ci=1"
     network_mode: "service:fips"