chore: Refactor maintenance recipes and docs

This is a major refactoring of version management and other tooling designed to
remove most manual steps in the maintenance documentation. The changes are
fairly extensive, but only affect maintainers. It is now assumed that *all*
version updates are done through the `just` recipes.

The documentation is probably better to read, because the *downside* to
embedding scripts in a `Justfile` is that they are harder to read.

- Changed `version` recipe to behave like the previous `version` task if
  a `VERSION` parameter is not provided, or like `set-version` if it is
  provided, while also printing *both* the pre and post version updates. Removed
  `set-version`.

- Added a `tag` recipe to create a git tag for the current image version.

- Renamed `*-set-version VERSION` to just `*` (that is, `alpine-set-version` is
  now just `alpine VERSION`, etc.).

- Removed recipes `pgtap-set-hashref` and `pgtap-remove-hashref` and integrated
  the core functionality into the `pgtap` recipe.

- Refactored the `update_package_version` private recipe to be able to handle
  grouped changes better as is required for the `pgtap` recipe. This allows
  "dependency" update rather than subtask update (this mostly reduces task
  duplication).

- Added a new `postgres` recipe to manipulate `build/pgtap/versions.json`. The
  only capability not present is *removal*, but given the pgTAP build process at
  this point (and that old versions have not yet been removed from pgTAP),
  manual removal is OK. It's still fairly limited in that `just postgres 11`
  will *clear* any attributes currently set (this is quite intentional and
  documented), so all required attributes must be set with each call.

- The `pgtap`, `postgres`, and `alpine` recipes will conditionally trigger the
  recipe `update-pgtap` (which downloads and rebuilds the pgTAP cache).

- The recipe `update-pgtap` will now call `update-do_pgtap` to regenerate the
  PostgreSQL versions clause in `scripts/do_pgtap` based on
  `build/pgtap/versions.json` after an otherwise successful build.