ci: build a docker image and push to ghcr registry

[mrsimonemms]

Builds the Docker image and pushes to the local registry.

Rules:

• if tag (in format v*.*.*), build and pushes:
  • linux/amd64 and linux/arm64 images
  • latest tag
  • versioned tag (eg, for Git tag v1.2.3, creates :1.2.3
  • tag with commit's SHA
• if non-tag, builds:
  • linux/amd64 image
  • tag with commit's SHA
  • only pushes if in main branch

[mrsimonemms]

Only one potential issue here about the GHCR push rights - I think I've got it right, based on previous things I've used, but I'm not 100% certain. I can't test as I don't have write access to the temporal-sa org.

If it's broken on merge, I'll fix.