Tag published builder images with commit SHA (#269)

When the action is referenced by SHA, the version step extracts the SHA from
github.action_path and uses it as the Docker image tag. Without a corresponding
SHA-tagged image, the pull fails.

By publishing each image with the commit SHA as an additional tag, SHA-pinned
references resolve to a valid image.

Author: sairon

.github/workflows/publish.yml

@@ -58,4 +58,5 @@ jobs:
             --${{ matrix.architecture }} \
             --target /data \
             --cosign \
+            --additional-tag ${{ github.sha }} \
             --generic $GIT_TAG_NAME