ci: clean old container images, document how to push images

[avivace]

Following up #1509 :

• document how to manually push an image (e.g. old tag, without having to repush it)
• find a way to clean up the old artifacts

[Rangi42]

@avivace Any updates on auto-deleting all those sha256:... packages?

[ISSOtm]

GITHUB_TOKEN cannot be granted admin permissions for a scope (only read, write, or none), and admin perms are required to delete containers.

So I think what needs to be done, is for @avivace to generate a PAT for the gbdev org (so it's not tied to a specific maintainer), and pass that to the action via secrets.