workflows: Build ws container from latest tag, not main

[martinpitt]

So far we always built cockpit/ws with the latest main Dockerfile. But this broke the most recent cockpit/ws build (tag 329): It already removed cockpit session due to commit 035dc2d, but the rpms don't yet contain the prerequisite commit d7cb561 (that isn't in any release yet).

Let's not get ahead of ourselves and always build the container from the current release, not main.

---

See cockpit-project/bots#7141 where that broke badly. This can be trivially reproduced with

sudo podman container runlabel RUN quay.io/cockpit/ws:329

and going to http://localhost:9090 . This only affects privileged mode, unprivileged is fine.

I already reverted the ":latest" tag back to the previous build (327, sic!). I'll do a rebuild against this branch now and validate the result: https://github.com/cockpit-project/cockpit/actions/runs/12025898351

[martinpitt]

rebuilt, the log shows that it does not remove cockpit-session and checks out 329.1. Retested as per instructions above with quay.io/cockpit/ws:329.1 (I kept :latest at 327 as before).