ci(release): push images to Docker Hub alongside Quay (#743)

Quay keeps no lifetime pull counter — only daily rows, exposed for a
trailing 92 days (MAX_DAYS_IN_3_MONTHS in quay/quay). Docker Hub keeps a
monotonic one, and lakhansamani/authorizer already holds 5 years of it,
stalled since v2.2.1 when releases went Quay-only.

One buildx invocation carries both tag sets, so digests match and build
time is unchanged. Buildcache stays on Quay alone.

Reuses the existing DOCKER_USERNAME/DOCKER_PASSWORD secrets from when
releases last shipped to Docker Hub.

Author: lakhansamani

.github/workflows/release.yaml

@@ -19,6 +19,9 @@ on:
 
 env:
   DOCKER_IMAGE: quay.io/authorizer/authorizer
+  # Quay exposes no lifetime pull counter (only a trailing 92-day window), so
+  # the same image also goes to Docker Hub, which does.
+  DOCKERHUB_IMAGE: docker.io/lakhansamani/authorizer
   BUILDKIT_INLINE_CACHE: 1
 
 jobs:
@@ -68,16 +71,21 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Build and push
         env:
           SOURCE_URL: https://github.com/${{ github.repository }}
         run: |
           VERSION=$(basename ${GITHUB_REF})
-          TAG_ARGS=(-t "${DOCKER_IMAGE}:${VERSION}")
+          TAG_ARGS=(-t "${DOCKER_IMAGE}:${VERSION}" -t "${DOCKERHUB_IMAGE}:${VERSION}")
           # Only a final release moves :latest. Match strict semver with no
           # pre-release suffix (vX.Y.Z / X.Y.Z) so rc/beta/alpha/pre never win.
           if [[ "$VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            TAG_ARGS+=(-t "${DOCKER_IMAGE}:latest")
+            TAG_ARGS+=(-t "${DOCKER_IMAGE}:latest" -t "${DOCKERHUB_IMAGE}:latest")
           fi
           docker buildx build \
             --platform linux/amd64,linux/arm64 \