Replaces the stub sync-artifacts job (added in !1435)
with actual skopeo copy commands to sync two image refs per release from
the security mirror's container registry to the canonical registry:

  1. :<tag>               container image (exact semver tag)
  2. /chart/<name>:<tag>  OCI Helm chart (exact semver tag)

--all copies full manifest lists for multi-arch support.

New input: canonical_registry_path -- the registry path of the canonical
project (e.g. gitlab-org/software-delivery/my-service).

New version pin: GL_COMMON_CI_TASKS_SKOPEO_VERSION in
.gitlab-ci-other-versions.yml (Renovate-managed, initial value 1.22.2).

The child pipeline also validates CANONICAL_REGISTRY_TOKEN is set before
attempting the copy, and retries up to 2 times on transient failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: sync container images and OCI Helm charts via skopeo copy

See merge request !1437

## [3.21.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-04-27)

### Features

* sync container images and OCI Helm charts via skopeo copy ([1122fe93](1122fe93))