Use Docker Buildx for image mirroring

[jgoux]

Summary

• replace the third-party image retag action with Docker Buildx imagetools create
• authenticate to Docker Hub, ECR Public, and GHCR before mirroring the manifest
• keep the Docker setup action pinned to the resolved v4 commit SHA

Context

Follow-up to Ziinc's comment on #3564: #3564 (comment)

Docker documents this copy-between-registries flow with docker buildx imagetools create: https://docs.docker.com/build/ci/github-actions/copy-image-registries/

Validation

• parsed .github/workflows/docker-retag-versioned.yml as YAML
• ran git diff --check
• ran actionlint .github/workflows/docker-retag-versioned.yml
• dry-ran the two-target docker buildx imagetools create command shape locally