fix: do not retag images unnecessarily

This change minimizes the work needed to be done when tagging images. It edits the image manifest directly only when necessary, allowing restarts of an app to avoid having an extra layer.

This also additionally allows to deploy images with ONBUILD directives without running the ONBUILD directives.

Lastly, users building docker images that run Dokku will need to use a new sudoer wrapper for the `docker-image-labeler` binary to work correctly. A reference version has been placed in the `docker` skeleton directory.

Closes #3931
Refs #4226

docker/etc/sudoers.d/dokku-docker

@@ -1 +1 @@
-dokku    ALL=NOPASSWD:SETENV:/usr/bin/docker
+dokku    ALL=NOPASSWD:SETENV:/usr/bin/docker,/usr/bin/docker-image-labeler

docker/usr/local/bin/docker-image-labeler

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $TRACE ]] && set -x
+
+main() {
+  declare desc="re-runs docker-image-labeler commands as sudo"
+  local DOCKER_IMAGE_LABELER_BIN=""
+  if [[ -x "/usr/bin/docker-image-labeler" ]]; then
+    DOCKER_IMAGE_LABELER_BIN="/usr/bin/docker-image-labeler"
+  fi
+
+  if [[ -z "$DOCKER_IMAGE_LABELER_BIN" ]]; then
+    echo "!   No docker-image-labeler binary found" 1>&2
+    exit 1
+  fi
+
+  sudo -E "$DOCKER_IMAGE_LABELER_BIN" "$@"
+}
+
+main "$@"