Ooof, I figured it out finally. The issue was indeed with docker and the host network, not discourse.
Hetzner, if you run a vSwitch with a public Subnet, requires the MTU to be set to 1400 instead of 1500. I did change that at some point, but apparently that change got reverted at some point. So I had to redo that and restart Docker with the correct MTU.
Now the Update-Site withoin discourse works as well.
Funny how everything else worked the whole time.