Add KeepLatestNDockerImagesAllVersions rule (fix #183)

[sdn2s]

What

Adds a new Docker keep rule KeepLatestNDockerImagesAllVersions that protects the latest N image digests computed over all tags in the repository, independently of the other rules in the policy.

Fixes #183.

Why

All rules in a policy contribute to a single AQL find combined with $and (CleanupPolicy._get_aql_find_filters), and Keep* rules run their in-memory filter() on the already-narrowed result set. So when a policy mixes a filtering Delete* rule (e.g. DeleteDockerImagesNotUsed) with KeepLatestNDockerImages, the keep rule only sees the artifacts that survived the delete filter and therefore cannot protect the truly latest N versions.

Consequence: the very common retention intent — "delete images not used for N days, but always keep the latest M versions" — is not expressible in a single policy, and on many datasets the policy deletes nothing (see #183 for the detailed analysis).

How

KeepLatestNDockerImagesAllVersions:

• issues its own AQL query for every manifest in the affected repos (items.find(...).include("*")), independently of the policy's delete filter;
• computes the latest N digests per image by updated (same semantics as KeepLatestNDockerImages);
• protects the candidate artifacts whose digest is among those latest N.

Usage:

- rule: DeleteDockerImagesNotUsed
  days: 120
- rule: KeepLatestNDockerImagesAllVersions
  count: 5