images: add custom image which packages SOPS. update renovate and add publishing workflow

renovate.json

@@ -13,6 +13,14 @@
         "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+[A-Z0-9_]+\\s*:\\s*[\"']?(?<currentValue>[^\\s\"'#]+)[\"']?"
       ],
       "description": "match any pinned dependency using SCREAMING_SNAKE_CASE naming as ENV"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["**/Dockerfile"],
+      "matchStrings": [
+        "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)[ \\t]*\\n[ \\t]*ARG\\s+[A-Z0-9_]+=(?<currentValue>[^\\s\"'#]+)"
+      ],
+      "description": "match pinned ARG deps in Dockerfiles"
     }
   ]
 }