Mirror external artifacts used in a gitpod release under our gcr.io namespace

Is your feature request related to a problem? Please describe

For organizations that are operating in an airgapped mode but have to pull images through their registries instead pushing them via the kots cli, one step in configuring the mirror process may require them to get each images registry added to an allowlist. In practice this can take weeks or months for some organizations.

Describe the behaviour you'd like

We should minimize this to as few registries as possible and since https://github.com/gitpod-io/gitpod/issues/12812 would mean we will have to be able to add custom tags to these third party images, they will have to be pushed to gcr.io anyway.

If a customer doesn't have gcr.io on their allow list, they will still have to go through this process, but they will only have to do this one time when they first setup gitpod and never again.

Start by reviewing the Gitpod release process and the related issue #12812 to identify which external image artifacts need custom tags and mirroring. Confirm the current registries used by a release and define the change as complete when those artifacts are available under the gcr.io namespace, reducing the registries customers must allowlist.