Feature: Add collision-resistant randomness to container image tags

### Is your feature request related to a problem?

When `azd deploy` runs for container-based services, the default image tag is generated from `time.Now().Unix()` (seconds since epoch). If two deployments happen within the same second (e.g. parallel CI pipelines, scripted multi-environment rollouts, or retry logic that re-triggers quickly), they produce identical tags. This means the second push silently overwrites the first image in the registry, and any service still referencing that tag may get unexpected content.

### Describe the solution you'd like

Add a short random suffix to `DefaultImageTag()` so that tags are collision-resistant by construction. For example, changing from:

```go
func (ch *ContainerHelper) DefaultImageTag() string {
return fmt.Sprintf("azd-deploy-%d", ch.clock.Now().Unix())
}
```

to something like:

```go
func (ch *ContainerHelper) DefaultImageTag() string {
buf := make([]byte, 6)
_, _ = rand.Read(buf)
return fmt.Sprintf("azd-deploy-%d-%x", ch.clock.Now().Unix(), buf)
}
```

This produces tags like `azd-deploy-1752883200-a3f1b2c4d5e6` that are unique even under same-second concurrency, while remaining human-readable and sortable by timestamp.

### Describe alternatives you considered

- **Project-level hook scripts** that generate custom tags and store them in azd env vars before the deploy lifecycle runs. This works but forces every project to reimplement the same logic and adds maintenance burden outside of azd.
- **Using git commit SHA as the tag**. This is collision-resistant but loses the deployment-time ordering that `azd-deploy-{timestamp}` provides, and doesn't work for dirty working trees.

### Additional context

The current `DefaultImageTag()` lives in `cli/azd/pkg/project/container_helper.go`. The change is minimal (one function, one import) and backward-compatible since nothing depends on the exact tag format.

Start in cli/azd/pkg/project/container_helper.go at DefaultImageTag() and inspect nearby tests or test helpers for ContainerHelper and clock behavior. Done means default tags retain the timestamp while adding collision-resistant randomness, and relevant tests verify the format and distinct tags for deployments in the same second.

Written by the indexing model from the issue text.