Feature: Add collision-resistant randomness to container image tags

Start in cli/azd/pkg/project/container_helper.go at DefaultImageTag() and inspect nearby tests or test helpers for ContainerHelper and clock behavior. Done means default tags retain the timestamp while adding collision-resistant randomness, and relevant tests verify the format and distinct tags for deployments in the same second.

Is your feature request related to a problem?

When azd deploy runs for container-based services, the default image tag is generated from time.Now().Unix() (seconds since epoch). If two deployments happen within the same second (e.g. parallel CI pipelines, scripted multi-environment rollouts, or retry logic that re-triggers quickly), they produce identical tags. This means the second push silently overwrites the first image in the registry, and any service still referencing that tag may get unexpected content.

Describe the solution you'd like

Add a short random suffix to DefaultImageTag() so that tags are collision-resistant by construction. For example, changing from:

func (ch *ContainerHelper) DefaultImageTag() string {
    return fmt.Sprintf("azd-deploy-%d", ch.clock.Now().Unix())
}

to something like:

func (ch *ContainerHelper) DefaultImageTag() string {
    buf := make([]byte, 6)
    _, _ = rand.Read(buf)
    return fmt.Sprintf("azd-deploy-%d-%x", ch.clock.Now().Unix(), buf)
}

This produces tags like azd-deploy-1752883200-a3f1b2c4d5e6 that are unique even under same-second concurrency, while remaining human-readable and sortable by timestamp.

Describe alternatives you considered

• Project-level hook scripts that generate custom tags and store them in azd env vars before the deploy lifecycle runs. This works but forces every project to reimplement the same logic and adds maintenance burden outside of azd.
• Using git commit SHA as the tag. This is collision-resistant but loses the deployment-time ordering that azd-deploy-{timestamp} provides, and doesn't work for dirty working trees.

Additional context

The current DefaultImageTag() lives in cli/azd/pkg/project/container_helper.go. The change is minimal (one function, one import) and backward-compatible since nothing depends on the exact tag format.