ci(docker): incorporate docker release enhancements from uv

[samypr100]

Summary

This PR updates ruff to match uv updated docker releases approach. It's a combined PR with changes from these PR's

• feat: introduce more docker tags for uv uv#6053
• feat: use multi-runner on docker publish uv#6556
• feat: publish tag without patch version uv#6734

Summary of changes / features

1. This change would publish an additional tags that includes only major.minor.

   For a release with x.y.z, this would publish the tags:

   • ghcr.io/astral-sh/ruff:latest
   • ghcr.io/astral-sh/ruff:x.y.z
   • ghcr.io/astral-sh/ruff:x.y

2. Parallelizes multi-platform builds using multiple workers (hence the new docker-build / docker-publish jobs), which cuts docker releases time in half.

3. This PR introduces additional images with the ruff binaries from scratch for both amd64/arm64 and makes the mapping easy to configure by generating the Dockerfile on the fly. This approach focuses on minimizing CI time by taking advantage of dedicating a worker per mapping (20-30s~ per job). For example, on release x.y.z, this will publish the following image tags with format ghcr.io/astral-sh/ruff:{tag} with manifests for both amd64/arm64. This also include x.y tags for each respective additional tag. Note, this version does not include the python based images, unlike uv.

   • From scratch: latest, x.y.z, x.y (currently being published)
   • From alpine:3.20: alpine, alpine3.20, x.y.z-alpine, x.y.z-alpine3.20
   • From debian:bookworm-slim: debian-slim, bookworm-slim, x.y.z-debian-slim, x.y.z-bookworm-slim
   • From buildpack-deps:bookworm: debian, bookworm, x.y.z-debian, x.y.z-bookworm

4. This PR also fixes org.opencontainers.image.version for all tags (including the one from scratch) to contain the right release version instead of branch name main (current behavior).

   > docker inspect ghcr.io/astral-sh/ruff:0.6.4 | jq -r '.[0].Config.Labels'
   {
     ...
     "org.opencontainers.image.version": "main"
   }
   

Test Plan

Approach mimics uv with almost no changes so risk is low but I still tested the full workflow.

• I have a working CI release pipeline on my fork run https://github.com/samypr100/ruff/actions/runs/10746243189
• The resulting images were published to https://github.com/samypr100/ruff/pkgs/container/ruff

[samypr100]

CC @zanieb