Add stable distributions SHAs
=============================

Record the SHA of base distribution images at the start of final image
building process. This ensure that all images will have a common base
layer even if upstream updates a floating tag during pipeline
execution. This also automatically breaks cache if the upstream image
changes between pipeline runs!

Refactor CI to use include, extends, rules
==========================================

Simplify the `rules` and `needs` definitions on a per-Job level by
refactoring / dividing the Jobs to make use of:

- [workflow:rules](https://docs.gitlab.com/ee/ci/yaml/workflow.html#workflow-rules-examples)
- [include:rules](https://docs.gitlab.com/ee/ci/yaml/includes.html#use-rules-with-include)
- [extends](https://docs.gitlab.com/ee/ci/yaml/#extends)
- [reference](https://docs.gitlab.com/ee/ci/yaml/yaml_optimization.html#reference-tags)
- [rules & reference](https://docs.gitlab.com/ee/ci/jobs/job_control.html#reuse-rules-in-different-jobs)

This divides the `.gitlab-ci.yml` into parts, using `include` to pull
them back in from `.gitlab/ci/*`.

The resulting division:

- `rules`, only `rules` and DRY componets for `rules`
- `deps`,  just dependencies.io job
- `common`, with all base job definitions, commonalities to all of CI
- `debian`, debian specific definitions and `extends` for each image
- `ubi`, UBI specific definitions and `extends` for each image

The goal of this is to make it far less complicated to define job
inter-dependency, as we now separate them based on the pipeline type
via the `include` stanza of `.gitlab-ci.yml` using `rules`.

Dividing up the YAML necessitated the move from any anchor merging
(`<<: *job-base`) to the use of `extends` and `reference`.

ALSO: move `when: always` to `when: on_success` where appropriate
Note, that `on_success` is the default, so some instances removed.

See also: https://gitlab.com/gitlab-org/build/CNG/-/merge_requests/956/#note_903075014

Changelog: other