Build and publish the Relay image with GLAZ from CI

Relay's CI builds no kas image; CNG does, and the existing //cmd/kas:push target produced a pure, cross-compiled amd64 image without the GLAZ policy engine, which nothing consumed. Theseus deploys the image a repository publishes itself.

This adds relay, a Bazel-built image of kas with GLAZ linked in through cgo, on a distroless cc base, for linux/amd64 and linux/arm64. rules_go cross-compiles image binaries in pure mode and the GLAZ archive is fetched for the host platform only, so each architecture is built on a runner of that architecture, marked incompatible elsewhere, and the two images are combined into one index afterwards. CI publishes relay:<sha> on the default branch, and from a merge request once its manual job is started, and relay:vX.Y.Z on release tags, cosign-signed like the agentk images. Each leg builds the regular and the debug image in one Bazel invocation and pushes them concurrently through rules_multirun. The pure //cmd/kas:push targets, which nothing used, are removed; bazel run //cmd/kas:relay_load loads the image into a local Linux Docker daemon.

The arm64 leg needs the regular CI image as a multi-arch manifest list, which gitlab-agent-ci-image!139 (merged) delivered and !4427 (merged) pinned on master.

See commits 🕵️

Refs #1100 (closed)