Expand variables in image_name log fields

Summary

When the feature flag FF_LOG_IMAGES_CONFIGURED_FOR_JOB is enabled (originates in Log images used by job (!4325 - merged)), Build.logUsedImages writes image_name (and service image_name) to the log so operators can see which images a job uses.

The call was placed before Build.expandContainerOptions, so the logged image_name still contained unexpanded variable references (e.g. $CI_REGISTRY_IMAGE/foo:latest) — making the log effectively useless when image names are built from CI variables.

This MR moves b.logUsedImages() to run after b.expandContainerOptions() (which itself runs after resolveSecrets, so secret-backed variables are also expanded). The log now reflects the value the executor will actually use.

Why

Trying to analyze image names in logs is not possible when the image name is built from a variable.

For example, as part of macos-26 image GA and remove deprecated macos-1... (gitlab-com/gl-infra/production-engineering#28487 - closed) where I'd like to validate that older images are no longer being used.

Trade-off

If resolveSecrets fails, the log line is no longer emitted. I think this is acceptable, the build will fail with a BuildError that surfaces the secret-resolution problem, and a partially-expanded image_name in the log would not be very useful.

This logging also sits behind the feature flag, so this won't impact typical logging behavior.