Use MEPHI mirror, disable security repo, fix memtest in ISO build

- Switch all lb mirrors to mirror.mephi.ru/debian/ for faster/reliable downloads
- Disable security repo (--security false) — not needed for LiveCD
- Pin MEMTEST_VERSION=6.10-4 in VERSIONS, export to hook environment
- Set BEE_REQUIRE_MEMTEST=1 in build-in-container.sh — missing memtest is now fatal
- Fix 9100-memtest.hook.binary: add apt-get download fallback when lb
  binary_memtest has already purged the package cache; handle both 5.x
  (memtest86+x64.bin) and 6.x (memtest86+.bin) BIOS binary naming

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build-in-container.sh

@@ -161,6 +161,7 @@ run_variant() {
             -e GOMODCACHE=/cache/go-mod \
             -e TMPDIR=/cache/tmp \
             -e BEE_CACHE_DIR=/cache/bee \
+            -e BEE_REQUIRE_MEMTEST=1 \
             -w /work \
             "${IMAGE_REF}" \
             sh /work/iso/builder/build.sh --variant "${_v}" \
@@ -175,6 +176,7 @@ run_variant() {
             -e GOMODCACHE=/cache/go-mod \
             -e TMPDIR=/cache/tmp \
             -e BEE_CACHE_DIR=/cache/bee \
+            -e BEE_REQUIRE_MEMTEST=1 \
             -w /work \
             "${IMAGE_REF}" \
             sh /work/iso/builder/build.sh --variant "${_v}"