Add unique per-build image tags via generate-tags task

[dandersonsw]

Changes proposed in this pull request:

Introduce a generate-tags task that produces immutable, traceable image tags in place of the standalone short_ref tag, which was not unique per build (base-image bumps, weekly rebuilds, and common-dockerfiles changes rebuild the same commit and would overwrite it).

Each build is now tagged with:

• - sha256 hex of the image config digest,
  guaranteed unique for any image change
• <short_ref>- - human-readable, commit-traceable tag

The staging job uses tag_prefix: staging- to keep staging artifacts distinct from promoted tags. generate-tags validates tag length against the 128-character OCI/ECR limit and fails closed.

Wire the task into the main and staging jobs of the base, external, internal, and pages pipelines, and document the tagging scheme in the container README.

Things to check

• For any logging statements, is there any chance that they could be logging sensitive data?
• Are log statements using a logging library with a logging level set? Setting a logging level means that log statements "below" that level will not be written to the output. For example, if the logging level is set to INFO and debugging statements are written with log.debug or similar, then they won't be written to the otput, which can prevent unintentional leaks of sensitive data.

Security considerations

Having these unique tags for our images will make it easier to track them, roll back to a previous version if necessary, and allow us create better lifecycle policies for our ECR repos.