Add support for tag immutability
From the Docker EE DTR documentation:
By default, users with read and write access to a repository can push the same tag multiple times to that repository. For example, when user A pushes an image to library/wordpress:latest, there is no preventing user B from pushing an image with the same name but a completely different functionality. This can make it difficult to trace the image back to the build that generated it.
To prevent tags from being overwritten, you can configure a repository to be immutable. Once configured, DTR will not allow anyone else to push another image tag with the same name.
We should support immutable tags as an additional security feature and to improve traceability.
This can only be implemented once we have the metadata database in place.
Related to gitlab#18984 (closed).