CI: tag containers in a meaningful way (Fixes #40345).

If there was a push to main, build a container with the tag latest. If there was a tag pushed, then build a container with the container tag set to the git tag, additionally setting a stable` tag that matches.

Because the process creates a number of temporary intermediary containers before they are merged into one with the merge-manifests job ($tag_amd64, $tag_arm64, $tag_s390x, latest_amd64, latest_arm64, latest_s390x) which are only useful for the merge-manifests job, we clean these up in the clean_image_tags job using the gitlab API