fix(ci): build container images on native arm64 runners

[kkopanidis]

Alpine pinning helped but authentication still SIGILL'd under QEMU on the post-#1494 run. This drops QEMU entirely: each platform builds natively, pushes by digest, and the manifest job stitches :dev / release tags afterward.

Summary

• Split build into build_amd64 (ubuntu-24.04) and build_arm64 (ubuntu-24.04-arm)
• Platform jobs push to GHCR by digest only (provenance/sbom off so merges stay clean)
• New manifest job merges digests with imagetools create and mirrors release tags to Docker Hub
• Per-arch GHA cache scopes ({target}-amd64 / {target}-arm64)
• Add .github/CONTAINER_IMAGES.md documenting the native build flow

Test plan

• Merge and run workflow_dispatch with channel=all
• Confirm Build authentication (linux/arm64) passes (primary regression)
• Confirm all Merge * manifest jobs succeed
• docker buildx imagetools inspect ghcr.io/conduitplatform/authentication:dev shows amd64 + arm64

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other (please describe)

Does this PR introduce a breaking change?

• Yes
• No

Published image tags and registry layout are unchanged; only how multi-arch manifests are assembled in CI.

The PR fulfills these requirements:

• It's submitted to the main branch
• When resolving a specific issue, it's referenced in the PR's description

Other information:

Requires GitHub-hosted ubuntu-24.04-arm runners for build_arm64.