run tools/merge_image_refs.py in CI

The following discussion from !3384 (merged) should be addressed:

• @tmmorin started a discussion: (+9 comments)

  you wrote:

  This script should be triggered when a release is tagged (manually or in CI) and may aid in security scanning and air-gapped deployments.

  Why not, similarly as in !3161 (merged), add in this MR the CI config to runs this script at the end of each pipeline ?