Design solution so that users don't need to create and push to their own DockerHub repo

[WillEngler]

Currently users need to create a public repository on their personal DockerHub accounts and then specify that repo to the publish command. They also need to be logged in to DockerHub when running publish. This is one of the bigger known kludges in the new publishing workflow.

It would be good

Assumptions:

1. This is a research spike ticket. The outcome should be a mini design doc and tickets for implementation.

Acceptance Criteria (for the end product)

Given I am a Garden publisher, when I publish a pipeline, then I don't need to think at all about my personal DockerHub account.

[WillEngler]

We've landed on pushing images to a Garden-hosted ECR repo. Sub-steps will be ...

• infra: make dev and prod repos
• backend: make a new endpoint that doles out temporary STS tokens to end users
• SDK: after building a container, fetch an STS token and push the container to ECR. (Also clean up any DockerHub stuff)