Deploy Docker image digest instead of Docker tags
Deploy Docker image digest instead of Docker tags

Our current operational model is:

- Build, tag and push Docker images in the `build` CI job
- Deploy the `repo:$CIRCLE_SHA1` docker image to Kubernetes

Ultimately, it would be nice if we can avoid pushing the `$CIRCLE_SHA1`
Docker tags to the repository for feature branches. This is because
these references are superseded by the `master` build once the feature
branch is merged.

Because they are superseded, we do not have to keep them around after
the merge happens. Since our "Maximum number of images per repository"
is 1000, we want to delete old, unnecessary tags.

We cannot _easily_ delete tags that are git SHA references, as we have
no easy way to match and delete them.

In contrast, it's easy to set up a lifecycle policy for any branch that
is not master.

... But.

Kubernetes with `kubectl` will detect that a deployment is unchanged, if
we use branch names. (Yeah, `master` is already deployed, duh.)

So we need a mechanism to identify each "changed" image without leaving
unqualified git SHA references.

We could think of these options:

- Tag `branch.short_git_sha` for all builds.
- Use Docker's SHA256 digest on images, as Docker images can be pulled
  by their digests.

This changeset tries the first one as it's easier to understand and
identify what is deployed.

ministryofjustice/cla_public,ministryofjustice/cla_public,ministryofjustice/cla_public,ministryofjustice/cla_public