Automate publishing multiarch images to GHCR (migrate away from Docker Hub)

[klardotsh]

This reopens #395 in-house again, similar to #396, which now can't be reopened due to a force-push. The 403s found in this CI run are a forked-repo permissions problem; this PR suffers no such issues and can publish to GHCR successfully.

Supercedes #390 by building multiarch images in GHCR rather than depending on local workstation builds.

Blockers: https://github.com/orgs/zulip/packages/container/package/zulip needs to be made public, and I need to verify that this repo actually has permissions to push to that registry (while I'm an admin of the registry, I'm not an admin of this repo, so can't double-check the secrets plumbing behind the scenes that I vaguely recall being a thing to do here).

[klardotsh]

Before I go making the changes to run this workflow using tags instead of the version file, saving this link to a successful CI run which generated this GHCR manifest