Docker images rebuilding unnecessarily

[MattBlissett]

I had locked in on release 3.2.1 (docker based) - but notised that this tag is republished all the time (on every build? together with latest...) - while under releases on github 3.2.1 is 3 weeks old......

https://hub.docker.com/r/gbif/ipt/tags

If I docker pull 3.2.1 - do I get changes done after the release?

Originally posted by @steinho in #2860

https://builds.gbif.org/job/ipt-container/ is the job that has rebuilt the released IPT docker image. I think it's correct that we do this — there may be security updates in the underlying Tomcat image — but the job rebuilds too much:

1. docker inspect only works if the image is present locally, so if the local docker cache has been cleared it would always rebuild. It should be preceded by a docker pull.
2. docker build wouldn't (I think) rebuild if the code state is the same, so it would then need to be docker build --no-cache (or maybe the git commands make the state look different every time anyway).
3. Most importantly, the docker build doesn't seem to be reproducible, i.e. it gives a different hash every time. (try docker build --no-cache; docker inspect repeatedly). I don't know about making reproducible Java builds with Maven, maybe there's advice online.

But we could avoid needing reproducible builds by checking (and remembering) the .Id hash of the build image dependency, i.e. maven:3.8.8-eclipse-temurin-11 and tomcat:9.0-jdk17; if either has changed then a new version should be built.

Or maybe compare .Created between the IPT image and the tomcat/maven ones, to see if the dependencies were published after the latest IPT image.

Either way, the script should probably be moved out of Jenkins into the ./build folder with the other build scripts.