Pin a specific version of the image

We should pin a specific version for the AiiDAlab (or QE app) image we deploy on the demo server. As pointed out by @giovannipizzi, in this way we can safely deploy the latest image of the app without the risk of propagating potential issues in the server.

Now we do this:

```yaml
singleuser:
image:
name: aiidalab/qe
tag: latest
pullPolicy: Always
```

we should pin:

```yaml
singleuser:
image:
name: aiidalab/qe
tag: {{ environ('TAG') }}
pullPolicy: Always
```

also, maybe we can then put the `pullPolicy` to be `IfNotPresent` instead of `Always`, as maybe it can save startup time. We do not need to check the digest then (as now currently done using the `Always` policy), but only the tag name.