Canary builds should provide a stable tag

[magnetised]

Currently we build a "canary" image electricsql/electric:canary off of main. Because the tag electricsql/electric:canary is not stable, if we ask someone to pull an image based off of main, we have no idea which actual build they end up with.

We should tag canary images as electricsql/electric:canary and electricsql/electric:canary-$COMMIT_SHA so that electricsql/electric:canary always points to the most up-to-date build, but the same build is also available under an immutable tag.

[robacourt]

It's stable if you use the SHA (currently it's sha256:644c25271c09e663fed4439c5c68fbe8e57e5dcc0d67ea92df32a40cdb11b12a )

But currently there's no record of what version of main is what SHA, and github doesn't display a history of the SHAs.