ci: Move IMAGE_TAG Dockerfile ARG into build phase

[chaudum]

What this PR does / why we need it:

In order to access the variable ${IMAGE_TAG} that is provided as --build-arg IMAGE_TAG=x.x.x in the docker build command, the ARG definition in the Dockerfile needs to be inside the build step block, otherwise it is empty.

Special notes for your reviewer:

Fix for ##15939

[loki-gh-app]

The backport to release-3.3.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new branch
git switch --create backport-15983-to-release-3.3.x origin/release-3.3.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x ed061b3edd2a8006fddf6cad5b8226a2a1f337d6

When the conflicts are resolved, stage and commit the changes:

git add . && git cherry-pick --continue

If you have the GitHub CLI installed:

# Push the branch to GitHub:
git push --set-upstream origin backport-15983-to-release-3.3.x
# Create the PR body template
PR_BODY=$(gh pr view 15983 --json body --template 'Backport ed061b3edd2a8006fddf6cad5b8226a2a1f337d6 from #15983{{ "\n\n---\n\n" }}{{ index . "body" }}')
# Create the PR on GitHub
echo "${PR_BODY}" | gh pr create --title 'ci: Move IMAGE_TAG Dockerfile ARG into build phase (backport release-3.3.x)' --body-file - --label 'size/S' --label 'type/ci' --label 'backport' --base release-3.3.x --milestone release-3.3.x --web

Or, if you don't have the GitHub CLI installed (we recommend you install it!):

# Push the branch to GitHub:
git push --set-upstream origin backport-15983-to-release-3.3.x

# Create a pull request where the `base` branch is `release-3.3.x` and the `compare`/`head` branch is `backport-15983-to-release-3.3.x`.

# Remove the local backport branch
git switch main
git branch -D backport-15983-to-release-3.3.x