Container images: Support "template" images and use it for cuda-tests

The `gpu/cuda-tests` and `gpu/cuda-tests-12-8` are duplicates of each other,
other than the CUDA version they use. As more CUDA versions are added, this
isn't a scalable pattern.

This change adds support in the `Makefile` (more specifically
`tools/images.mk`) for "image templates" and "image template instances".
If an image directory ends in `.tmpl`, it will be ignored from the set of images
that the `Makefile` recognizes. Instead, this directory can be used to
instantiate other images.

For example, given the following filesystem structure:

```
images/
├─ my-little-image.tmpl/
│  └─ Dockerfile
├─ my-little-image.foo.bar → my-little-image.tmpl (symlink)
└─ my-little-image.baz.qux → my-little-image.tmpl (symlink)
```

Then this will effectively create two images, `my-little-image.foo.bar` and
`my-little-image.baz.qux`. It will not create a `my-little-image.tmpl` image.

The behavior of the template instance images is determined by the
`TEMPLATE_VERSION` build argument passed to `my-little-image.tmpl/Dockerfile`.
This argument takes on the value of everything after the first `.` character of
the last component of the template instance image name. For example, the image
`my-little-image.foo.bar` will be built with `docker build
--build-arg=TEMPLATE_VERSION=foo.bar`, whereas the `my-little-image.baz.quux`
will be built with `docker build --build-arg=TEMPLATE_VERSION=baz.qux`. The
`my-little-image.tmpl/Dockerfile` image definition file can use this variable to
make the necessary tweaks to distinguish these two images.

#codehealth

PiperOrigin-RevId: 756101224

Author: EtiennePerot

Makefile

@@ -291,7 +291,7 @@ simple-tests: unit-tests # Compatibility target.
 .PHONY: simple-tests
 
 # Images needed for GPU smoke tests.
-gpu-smoke-images: load-gpu_cuda-tests load-gpu_cuda-tests-12-8
+gpu-smoke-images: load-gpu_cuda-tests.12.2.2 load-gpu_cuda-tests-12.8.1
 .PHONY: gpu-smoke-images
 
 gpu-smoke-tests: gpu-smoke-images $(RUNTIME_BIN)
@@ -338,7 +338,7 @@ cos-gpu-all-tests: gpu-images cos-gpu-smoke-tests $(RUNTIME_BIN)
 	@$(call sudo,test/gpu:sniffer_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
 .PHONY: cos-gpu-all-tests
 
-cuda-tests: load-basic_alpine load-gpu_cuda-tests $(RUNTIME_BIN)
+cuda-tests: load-basic_alpine load-gpu_cuda-tests.12.2.2 $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),--nvproxy=true --nvproxy-docker=true --nvproxy-allowed-driver-capabilities=all)
 	@$(call sudo,test/gpu:cuda_test,--runtime=$(RUNTIME) -test.v $(ARGS))
 .PHONY: cuda-tests

images/README.md

@@ -67,3 +67,65 @@ achieved by specifying `ARCH` variable to make. For example:
 ```
 $ make ARCH=aarch64 rebuild-default
 ```
+
+## Templated images
+
+If an image directory ends in `.tmpl`, it will be ignored from the set of images
+that the `Makefile` recognizes. Instead, this directory can be used to
+instantiate other images.
+
+For example, given the following filesystem structure:
+
+```
+images/
+├─ my-little-image.tmpl/
+│  └─ Dockerfile
+├─ my-little-image.foo.bar → my-little-image.tmpl (symlink)
+├─ my-little-image.baz.qux → my-little-image.tmpl (symlink)
+└─ this README.md file
+```
+
+Then this will effectively create two images, `my-little-image.foo.bar` and
+`my-little-image.baz.qux`. It will not create a `my-little-image.tmpl` image.
+
+The behavior of the template instance images is determined by the
+`TEMPLATE_VERSION` build argument passed to `my-little-image.tmpl/Dockerfile`.
+This argument takes on the value of everything after the first `.` character of
+the last component of the template instance image name. For example, the image
+`my-little-image.foo.bar` will be built with `docker build
+--build-arg=TEMPLATE_VERSION=foo.bar`, whereas the `my-little-image.baz.quux`
+will be built with `docker build --build-arg=TEMPLATE_VERSION=baz.qux`. The
+`my-little-image.tmpl/Dockerfile` image definition file can use this variable to
+make the necessary tweaks to distinguish these two images.
+
+Note that build arguments do not carry over `FROM` lines in `Dockerfile` unless
+specifically passed. For example, this will not work:
+
+```dockerfile
+# You should put this line at the top of the file to clearly indicate
+# to users that don't use the `Makefile` build system that they are going
+# to be building an image that doesn't make sense:
+ARG TEMPLATE_VERSION=POPULATED_BY_BUILD_SYSTEM
+
+FROM base-image:${TEMPLATE_VERSION}-alpine
+
+# WRONG: TEMPLATE_VERSION will not be defined here!
+# This will try cloning the empty string branch.
+RUN git clone https://some-url --branch="${TEMPLATE_VERSION}"
+```
+
+This will work:
+
+```dockerfile
+ARG TEMPLATE_VERSION=POPULATED_BY_BUILD_SYSTEM
+
+FROM base-image:${TEMPLATE_VERSION}-alpine
+
+# CORRECT: This declares that TEMPLATE_VERSION should be inherited from the
+# previous build stage; the lack of value assignment means that its value
+# should be carried over as-is.
+ARG TEMPLATE_VERSION
+
+# TEMPLATE_VERSION will be defined here.
+RUN git clone https://some-url --branch="${TEMPLATE_VERSION}"
+```