New Syft images should automatically be mirrored to the public cache ACR

Related: #4545, #5724

In dependency update PRs that update the Syft image tag, all PR validation legs will fail since the new Syft image has not been uploaded to the cache ACR. For example, https://github.com/dotnet/dotnet-docker/pull/5846.

The current workaround is to open a cloud shell and mirror the image manually:

```pwsh
# If needed, find the correct subscription ID
$team=""
az account list | Select-String "$team" -Context 5

$sub=""
$acrname=""
$tag=""

# Generate a new public, read-only DockerHub token with a short lifecycle otherwise you may encounter rate-limiting issues
$dockeruname=""
$dockertoken=""

az account set --subscription $sub
az acr import -n $acrname --source docker.io/anchore/syft:$tag --username $dockeruname --password $dockertoken
```