ci: uniform Docker builds

[JadedBlueEyes]

Change summary

This is the first part of breaking down #3380, as suggested. It's a few small changes to the docker build pipelines. From the top:

• Harden repo clones by setting persist-credentials: false as recommended by zizmor
• Consistently use the same docker/metadata-action invocation for each pipeline
• Apply labels & annotations from the metadata action
• Instruct build to build from the locally cloned repo, instead of cloning a second time
• Allow push job to run on forks
• Use the lowercase repo name in the push job

Checklist

• This PR contains no AI generated code
• book chapter included (if relevant)
• design document included (if relevant)

[CEbbinghaus]

Looks pretty good overall. I'll let @yaleman chime in to approve.

not needed