satlab: tag passport image directly via gcloud in Cloud Build

Unlike other shared images, passport:stable is pushed as a multi-arch
OCI Image Index (application/vnd.oci.image.index.v1+json). Using
docker pull, docker tag, and docker push on an amd64 Cloud Build worker
pulls only the linux/amd64 image and re-serializes it as a single-arch
Docker V2 manifest, changing the SHA-256 digest so the version tag is
not attached to the :stable digest.

Test a new approach on passport using gcloud container images add-tag,
which copies the raw manifest/index directly in Artifact Registry
without pulling layers, preserving the exact :stable digest and
multi-arch index. If any issues arise, this step can be reverted; if
successful, this approach can be propagated to all other shared images.

Also add PASSPORT_VER and call override_service_version.sh for PASSPORT
in src/dockerfiles/compose/Dockerfile so satlab-compose replaces
PASSPORT=stable in main.env with BUILD_VERSION (e.g. R-x.y.z on beta).

BUG=b:578394343
TEST=None
Change-Id: I7dab9a2cc9cc60454a93f58b3c88b6ff3894ecfa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/satlab/+/8690309
Reviewed-by: Przemysław Filipek <filipek@google.com>
Auto-Submit: Rafał Gaweł <rafalgawel@google.com>
Tested-by: Rafał Gaweł <rafalgawel@google.com>
Commit-Queue: Przemysław Filipek <filipek@google.com>