Kaniko default behavior changed, `--tarPath` alone is not enough to skip the push to registry, `--no-push` is now required as well.
Reference:
GoogleContainerTools/kaniko#1503
When skipping the push on unchanged digests, it's not enough to push the current tag,
which is probably semver, we also need to push the latest, so we can later check if
the latest digest equals the currently built image
Github registry doesn't support digest yet, we need to download the manifest
and calculate the digest manually
Also fixing a few other issues:
* Multi-stage dockerfiles override /usr/local/lib, moved jq and reg to /kaniko instead
* The digest was fetched for the current tag, which doesn't exist yet. Fetching digest for the latest tag instead
