ci: rework multi-arch build

[SamyDjemai]

Some fixes to the currently failing Docker build workflow:

• rather than relying on caching which wasn't set up properly, build and push specific arch images with their own cache, then merge them into usable tags in the merge job
• setup proper GitHub token permissions for the whole workflow
• add latest tag to the latest Docker builds on main

There are some example runs on my fork: SamyDjemai#2
We can see that, using caching, the ARM64 build job drops from 3 hours to 4 minutes! (We will avoid these long build times when ARM64 hosted runners will be available for OSS projects).

[SamyDjemai]

Builds are failing due to insufficient GITHUB_TOKEN permissions as explained in this documentation. Should we set the workflow as approval only? Or should we restrict Docker image building/publishing to only happen on the main branch?

UPDATE: I've edited the workflow to only push images to GitHub Container Registry when on the main branch in this repo, or on any branch on forks.