Adding a canary CI target to test against upcoming dependencies

[apostasie]

This PR introduces a new CI target (held in a separate file) that uses unreleased, upcoming, or otherwise main versions of our dependencies.

Specifically, it is setting us forward on:

• the next golang version
• containerd main
• distribution upcoming v3
• buildkit last rc

and a few others on main.

The purpose of this is to constantly have a "canary" target that will let us proactively identify and address upcoming issues in our dependency ecosystem.

Right now, it is not testing everything. Specifically ignored on this target are freebsd and ipv6 targets.

This will fix #3208

This PR also modifies slightly our "main" testing targets to pin containerd to an actual RC instead of main.

This is now running "green" - but of course would love feedback here so if you folks feel anything is missing / should be done differently, lmk and happy to discuss.

[apostasie]

@AkihiroSuda
With latest push:

• auto-detection of latest go release (+magic to convert it to a version acceptable to actions/setup-go)
• removed the stuff in Dockerfile to deal with empty GO_VERSION
• hook-up the variables into build-args

[update] reverting to draft for now. I like the idea of scraping versions to get the latest for everything instead of having to manually maintain these. This requires a little bit more work scraping github.

[apostasie]

CI is still running, but nevertheless, this is ready for the most part.

What this is now doing:

• for all dependencies listed at the top of ./hack/build-integration-canary.sh, retrieves the latest published version (alpha, beta, RC), and use that for integration test
• do the same thing for GO_VERSION

This is automatic - we do not have to manually maintain this file.
It is a bit slow (1 minute), and the script is a bit of a mouthful, but it does take care of everything (inc. the SHASUM files in case they are not here - which is fine, in that case).

I initially considered running (some) deps against their main / master, but after some tests, it seems like more trouble than reward.

Pending CI being green (or further comments here), PTAL at your convenience.

[apostasie]

@AkihiroSuda I think we are getting close.

Comment has been addressed, and now Windows also autodetect latest containerd.

I am now using the GITHUB_TOKEN magically injected secret.

PTAL at your convenience.

Sorry for the churn here. This one obviously needed a little bit of back and forth - and your suggestion to automate retrieval of latest Go prompted an interesting direction for the rest.

Thanks!

[AkihiroSuda]

Thanks