Introduce strategy for cleaning up outdated tags

[cvmiert]

We currently have no mechanism in place that can detect that we're building tags based on outdated images, e.g. an old alpine version. From a security perspective it would be nice to have some tracking mechanism/automation to deal with this, so that we don't build on top of unsupported base images.