Keeping referenced containers automatically up to date

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

We are sharing a bunch of internal integrations for containerised version of our apps. As our app is continuously delivered, we pretty much always want internal users using the latest version of our images, there are few options we could use to do this

1. Reference the mutable tag (e.g. `latest` / `production` / `stable`)
2. Use `WithImagePullPolicy(ImagePullPolicy.Always)`
3. Use a fixed image tag / sha in our published component, and re-publish our integration package

However each of these has drawbacks

1. Referencing the `latest` tag will get you the `latest` container when you first run your app, but from then on it will keep on using the local version and won't ever update itself (unless someone explicitly re-pulls the image)
2. `WithImagePullPolicy(ImagePullPolicy.Always)` will causes docker to fail to start if it cannot pull the image for any reason (no network, credential expired etc.)
3. This only keeps the container up to date if consumers keep the nuget package up to date. For continuously deployed apps, this could update the integration package several times a day which is a lot of updates - either manual or dependabot style prs).

### Describe the solution you'd like

Some kind of way that would allows us to try to get the up to date `latest` container, but allow falling back to a local one if you can't do so.

Something like the following would be awesome.
```cs
builder.AddContainer("redis", "redis")
.WithImagePullPolicy(ImagePullPolicy.IfPossible)
```

Unfortunately, this won't be as simple as the existing pull policies - the current pull policies are somewhat standardized and are natively implemented in docker and kubernetes, so Aspire needs to do little more than pass an additional command line argument / yaml configuration

- https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
- https://docs.docker.com/reference/cli/docker/container/run/#pull

But `IfPossible` would require Aspire doing a bit more clever work - My initial thought would be implementing of https://github.com/dotnet/aspire/issues/5625#issuecomment-2614797582 - having aspire handle the image pull separately from starting the container. In which case `IfPossible` would initially try to pull the image but continue on error. The container could then start if the image is already in the local cache, or fail if it wasn't.

For publish, `IfPossible`, would likely need to translate to `missing` / `IfNotPresent`, meaning `IfPossible` only applies locally.

### Additional context

Start with the AddContainer, WithImagePullPolicy, and ImagePullPolicy entry points described in the issue, then read the linked issue 5625 discussion and the Docker and Kubernetes pull-policy references. Define the local IfPossible behavior around a best-effort pull and local fallback, and confirm how publish translates it to missing or IfNotPresent.

Written by the indexing model from the issue text.