Make DOCKER_TAG more predictable in CI

Avoid using CI_JOB_ID, which is unique per job, and thus impossible to predict from an external view, like job A cannot know the CI_JOB_ID of job B without a lot of work to pass the value. Instead we use a combination of CI_PIPELINE_ID and the NSO version, which means we can predict the combined value from any job running within the same pipeline. As the upgrade test relies on getting the built docker images from the first build stage, we have to be able to refer to them by some name that we can easily figure out across the entire pipeline. This achieves that.

Closes #48 (closed)