image-refresh auto-push

[allisonkarlitskaya]

Good use case for put this commit into the PR :)

Originally posted by @jelly in #8857 (comment)

The idea that we discussed/sketched out would be that:

• the resulting image build gets pushed into the branch of the PR instead of a new image-refresh- branch on origin
• if there was a commit before it which contained only an update of that exact same image, that commit would be dropped. If any other file was touched in such an update (for lockstep updating of stuff) then it would be left alone because trying to drop the image from the commit would be complicated and would likely render the commit message inaccurate.
• we trigger relevant tests on the new image

[allisonkarlitskaya]

One more detail: the bot should not force-push. If it fails to push the branch because something has changed under it then probably it should fall back to pushing the new branch instead (ie: today's current behaviour) but with a clear message about what happened and why.