Remove `latest` tag from Docker engine images and implement semver for tags

[ierceg]

latest might be useful for dockerized applications but not for components like engines that depend on execution environment and which the environment expects to behave in a certain way. So we shouldn't have latest in engine Docker images. But this also means that we should provide a better way of dealing with security updates, fixes and so on beyond replacing exact engine versions that are specified in lazy.yaml. True, Docker images with the same tag can be replaced (unlike say npm versions which once published can only be unpublished but never replaced) but this may not hold for some other delivery mechanism on which we may decide in the future.

Useful links:

https://github.com/npm/node-semver
https://github.com/joyent/node-docker-registry-client
https://docs.docker.com/registry/spec/api/#/pulling-an-image-manifest (see "Existing Manifests" section)