ROX-27350: Setup ACS trusted tasks builds and publishing

[msugakov]

Notes

• This change can be reviewed per commits as I broke it down in chunks and put descriptions that seemed meaningful. However, due the large number of commits, it can be quicker to just review the final version.
• I know that duplication in determine-image-tag isn't great but it will not be the right time to address that now. Let's leave that for ROX-27384 or, most likely, ROX-26026.
• Some tasks in the build pipeline don't feel quite fine, e.g. clair-scan and clamav-scan but they aren't failing the pipeline either, and so I decided to keep them in the hopes that one day they may start working. By keeping the tasks it will hopefully be easier to conform EC when that will be required.

Links

• Goes on top of the initial pipelines setup Red Hat Konflux update acs-konflux-tasks #2 (already merged).
• Used in
  • ROX-27350: Use trusted tasks stackrox#13599
  • ROX-27350: Use trusted tasks scanner#1742
  • ROX-27350: Switch determine-image-tag to trusted task collector#1992
• Created these Quay repos:
  • quay.io/rhacs-eng/konflux-tasks for tasks themselves.
  • quay.io/rhacs-eng/konflux-tasks-trust for EC.

Testing

• Tested builds in the consuming repos are fine with the new tasks. See the PRs linked above.
• EC status is hard to present due to known issues of EC logs disappearing but I'm confident from earlier testing that all should be good once we update the policy.

[msugakov]

/retest acs-konflux-tasks-on-push

[msugakov]

/retest acs-konflux-tasks-on-push

[msugakov]

/retest acs-konflux-tasks-on-push

[msugakov]

/retest acs-konflux-tasks-on-push

[msugakov]

There was some failure during container build that seemed like a bug. It got resolved after I manually deleted a tag from Quay repo. Let's keep an eye on this in the future.

step-build
*Warning*: This is an experimental command, it's usage and behavior can change in the next release(s)
Creating Tekton Bundle:
	- Added Task: fetch-external-networks to image
	- Added Task: retag-image to image
	- Added Task: fetch-scanner-v4-vuln-mappings to image
	- Added Task: fetch-scanner-v2-data to image
	- Added Task: determine-image-tag-stackrox to image
	- Added Task: determine-image-tag to image
	- Added Task: wait-for-image to image
Error: could not push image to registry as "quay.io/rhacs-eng/konflux-tasks:rev-019ec288c660e477572c6f36c4bcf4c39855b856": GET https://quay.io:443/v2/rhacs-eng/konflux-tasks/manifests/rev-019ec288c660e477572c6f36c4bcf4c39855b856: MANIFEST_UNKNOWN: manifest unknown; map[]

Affected

1. https://console.redhat.com/application-pipeline/workspaces/rh-acs/applications/acs-konflux-tasks/pipelineruns/acs-konflux-tasks-on-push-jxc8v
2. https://console.redhat.com/application-pipeline/workspaces/rh-acs/applications/acs-konflux-tasks/pipelineruns/acs-konflux-tasks-on-push-vnl75