Draft: Nix assets e2e experiment, do not merge

What does this MR do?

Experiment, do not merge. It runs e2e:test-on-cng on gitlab-assets-ee images built with the Nix recipe of gitlab-org/software-supply-chain-security/hardened-builds, next to a run on the regular image of the same pipeline, and compares the results.

Run	Trigger	Assets image	Pipeline
A1	e2e:test-on-cng	regular, from build-assets-image	2945905318
B	e2e:test-on-cng nix-main	Nix, gitlab-org/software-supply-chain-security/hardened-builds main 61408d86	2945905318
A2	e2e:test-on-cng	regular, from build-assets-image	2946075989
C	e2e:test-on-cng nix-mr230	Nix, the split of gitlab-org/software-supply-chain-security/hardened-builds!230 (closed) on main 06e43474	2946075989

Results: e2e, name parity, build time and cost, and the Web IDE finding.

The commits:

1. Add a prototype build-assets-image-nix job. It locks gitlab-org/software-supply-chain-security/hardened-builds to the pipeline's commit, builds gitlab-assets-ee with Nix, pushes the image and compares its manifests with the regular image, using the check from gitlab-org/build/CNG!3159.
2. Run the job once per variant, pushing gitlab-assets-ee:<variant>-<sha>, and add a manual e2e:test-on-cng <variant> trigger for each. In the child pipeline, build-cng-env swaps in the Nix assets tag and its own CONTAINER_VERSION_SUFFIX. The Omnibus e2e trigger is off.
3. Point C at the split of gitlab-org/software-supply-chain-security/hardened-builds!230 (closed) and drop B, which ran in the first pipeline.

Once the results are read, the MR is closed and the two nix-* image tags are deleted.