Tag existing images with `previous` on re-build

Container builds using the `container-build@` systemd service will
generally tag any container image built with the `latest` tag, which is
then referred to pervasively in container executions.

However, this tag is overwritten when building new images, and, combined
with how `podman auto-update` will prune old image digests, may cause us
to lack the ability to roll back, automatically or otherwise.

This commit sets a `previous` tag on container re-builds, which should
only generally happen when source files change (due to the `ExecCondition`)
present on the service, which in turn should ensure that images are not
spuriously tagged as such.

host/base/systemd/container-build@.service

@@ -9,6 +9,7 @@ Type=oneshot
 SyslogIdentifier=%N
 Environment=PODMAN_BUILD_OPTIONS=
 ExecCondition=/bin/sh -c 'test -z "$(podman image list --quiet --filter until!="$(find %E/coreos-home-server/%i/{Containerfile,container} -type f -printf "%%T@\n" | sort -n | tail -1)" --filter reference=localhost/%i)"; exit $?'
+ExecStartPre=-/bin/podman image tag localhost/%i:latest localhost/%i:previous
 ExecStart=/bin/podman build $PODMAN_BUILD_OPTIONS --file %E/coreos-home-server/%i/Containerfile --tag localhost/%i:latest %E/coreos-home-server/%i
 
 [Install]