Adding new github actions workflow for pushing containers

[pputman-clabs]

Description

Adding a new github actions workflow to deploy containers in a more secure manner (using workload identity federation). This will have two service accounts, one that only the main branch has permission to assume, which pushes to a production artifact registry repo in the devopsre gcp project, and one which any branch can push to, which will push to a dev-images artifact registry repository.

It will build an image with two tags: one for the latest sha (of the commit if its a PR, of the merge commit if it's committed tom main), and one for the tag specified. Currently setting "testing" in dev-images repo and using the github tag for the production repo, but these are configurable.

The authentication is handled via keyless OIDC which uses github JWT tokens to identify the repository and branch, which if allowed will map to above service accounts.

it will also use sigstore to sign the image with githubs OIDC token, and use trivy to scan the repository for security vulnerabilities.

Tested

I've tested this workflow before, using a reusable workflow.

Issues

Would fix:
#152

Backwards compatibility

This isn't entirely backwards compatible. Due to the way that reusable workflows work, we can't pass variables between jobs, so I can't exactly imitate the functionality in the shell script that exists, which sets the name and version of the package automatically based on values in json.package

Workaround is that we can use github tags as the version, which may be better anyways. It would require the developer to push a tag with commits, but that tag would automatically be set as the version.
https://stackoverflow.com/questions/18216991/create-a-tag-in-a-github-repository