sync-containers command

The sync-containers command synchronizes container image tags from one registry to another.

It is intended as a workaround for ghcr.io's lack of good push credentials: you can either authorize "classic" Personal Access Tokens in your org (which are a common vector of very bad compromise), or you can get a short-lived credential in a Github action.

Since we publish to both Docker Hub and ghcr.io, we use this program in a Github action to effectively rsync from docker hub into ghcr.io, so that we can continue to forbid dangerous Personal Access Tokens in the tailscale org.