1ef5b92

build(images): Rebuild a floating layer when its upstream changes

The image layers that fetch from a floating source (the distribution
archive, Mozilla's and Google's apt repositories, proot-apps' and
FerrisPad's newest releases) were cached by their commands alone, so a
build reused them whenever nothing above them changed. The desktop
image is safe only while the base under it changes, and the base's own
packages refresh only when the distribution image or the Actions cache
turns over.

CI now reads each source's state before the build and passes it as a
build argument declared above the layers that fetch from it: the
archive's release-file dates, read in the distribution's own image on
the job's architecture, the two vendor repositories' release dates, and
the two releases' tags, which the fetches then take. A cached layer is
reused only while its source is unchanged. The coturn and turn-rest
images, small enough to build whole, take no cache at all, so a pip or
base-image update is never answered from a cached layer.