fix(ci): annotate OCI index so GHCR links the package to the repo

[davidgamez]

Description

The repo has no Packages section even though ghcr.io/mobilitydata/gtfs-validator-api
publishes successfully. The package is public with 9 tags, but it is not linked to
this repository.

PR #6 added LABEL org.opencontainers.image.source for exactly this purpose, and the
label is present on the published images. It does not link because a Dockerfile LABEL
only reaches the per-platform image configs, never the OCI image index that a
multi-platform push produces, and the index is what GHCR reads.

Current state vs. a working multi-arch reference:

mobilitydata/gtfs-validator-api:latest   index annotations: null
immich-app/immich-server:release         index annotations: {"org.opencontainers.image.source": ...}

Changes

• docker.yml: emit an image_url output (bare https://github.com/OWNER/REPO, no
  .git) alongside the existing image_source, and pass index:-prefixed
  annotations to docker/build-push-action, including org.opencontainers.image.source.
• Dockerfile: keep the existing ARG/LABEL from feat: automated project version management and docker release #6, which is what single-arch and
  local builds carry. Add title, description and licenses labels so the image
  stops inheriting Ubuntu's metadata and advertising itself as title=ubuntu.

Verification

Annotations only land at push time, so this is confirmable after merge:

T=$(curl -s 'https://ghcr.io/token?scope=repository:mobilitydata/gtfs-validator-api:pull&service=ghcr.io' | python3 -c 'import sys,json;print(json.load(sys.stdin)["token"])')
curl -s -H "Authorization: Bearer $T" -H "Accept: application/vnd.oci.image.index.v1+json" \
  https://ghcr.io/v2/mobilitydata/gtfs-validator-api/manifests/main \
  | python3 -c 'import sys,json;print(json.load(sys.stdin).get("annotations"))'

Prints None today; should print a dict containing the source URL. No release needed,
since merges to main already publish.

Caveat: this guarantees linkage for newly pushed images. Whether GHCR retroactively
links a package that was created unlinked back in June is unconfirmed. If the section
still does not appear after merge, that is the open question, not this change.