Source scan integration configurable image

[dj8yfo]

this adds ability to configure image via Cargo.toml :

[package.metadata.near.reproducible_build]
image = "docker.io/sourcescan/cargo-near:0.6.0-builder"
image_digest = "sha256:d21001ebc889478deac105a07efbefcd667d6a2e927e8ea5f1526cd1877ae84a"

cargo doesn't automatically populate package.metadata with workspace.metadata https://github.com/near-examples/update-migrate-rust/commit/d3259c3e9b6aaec3bf406fbaa2b3ac48aae695c8

        # package
        ...
        metadata: Object {
            "near": Object {
                "reproducible_build": Object {
                    "image": Object {
                        "workspace": Bool(true),
                    },
                },
            },
        },
        ...
        # workspace
        workspace_metadata: Object {
            "near": Object {
                "reproducible_build": Object {
                    "image": String("docker.io/sourcescan/cargo-near:0.6.0@sha256:bf488476d9c4e49e36862bbdef2c595f88d34a295fd551cc65dc291553849471"),
                },
            },
        },