Versions like 3.0.62.3 are long gone and are not coming back, we
don't need to keep the code which strips out the .0 on the second
position.

This was the case before I came but I was still first surprised that
my `misha-test-1` tag push triggered `release-ci.yaml`.
There I couldn't quickly figure if things would indeed be released.

not because 8 wasn't good.

There are multiple things:

1. Used `|` multiline string because otherwise GoLand drops
   indentation on reformatting.
2. Made `retag-` CEL expressions identical with others.
3. Added `release-` for both PR and push events. It's no-op in
   `master` but it allows having identical CEL expressions in both
   release and master branches. Less diff -> less chances for
   mistakes.

It's not used in the Dockerfile so we don't need to pass it.

Externally determined version gets injected in the BUILD_TAG so that
builds use that and don't try to do their own `make tag` thingy which
won't give them correct results for tagged builds.

This does the simplest part of
https://issues.redhat.com/browse/ROX-27230

The reason it's needed here is because of the commit that follows.

`MAIN_TAG_SUFFIX` became redundant the moment we start injecting
`BUILD_TAG`.

Two others, i.e. `COLLECTOR_TAG_SUFFIX` and `SCANNER_TAG_SUFFIX`
will be used only when the image flavor is `development_build`
and when it's not a release build. We know Konflux builds are
release builds since #13348.
We also know that Konflux builds will have `rhacs` image flavor and
that one relies on the unified tagging, i.e. only `BUILD_TAG` is
needed and `COLLECTOR_TAG_SUFFIX` and `SCANNER_TAG_SUFFIX` aren't.

I thought it's good to be a bit aggressive removing environment
variables because there's a lot of them already and dragging around
unused ones is worse than leaving them for the future when we'll be
onboarding non-release `development_build`-s on Konflux as a daily
driver. Besides, that future might look very differently (e.g. we may
want to have unified Dockerfiles).

building in Konflux, because the former one failed.

Simplified a couple of loops because it has been long since we
pushed to multiple repos at once and I'm not sure we'll need it
again.

so that later we can more easily disable the ones for RHACS_BRANDING.