Caddy tag should be given as an ARG in `Dockerfile`

[dra27]

The website image is pushed with both an amd64 and arm64 image - when Caddy 2.6.0 was released, the amd64 build happened before the push and the arm64 build after resulting in a single website multi-arch image with different software.

Here we can use an ARG with a default of alpine and then the deployment pipeline can use ocurrent to fix the sha256 of the manifest to ensure that's consistent in future.