nats declares the upstream image it is built from

The recipe started FROM the upstream server's digest directly, and the build machine
refuses that: every base is declared under build.on and copied into the mesh's own
store before a build, so a build never reaches out to a registry the mesh does not
run (novox/hq ADR 0097). Found the first time the module was built on a real mesh.

Same digest, now declared as NATS_BASE and arriving as a build argument; the
Dockerfile says where it comes from and why the digest is the index's.

modules/nats/module.json

@@ -73,6 +73,12 @@
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "NATS_BASE",
+        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
+      }
+    ],
     "artifacts": [
       {
         "name": "server",