feat: support container image fallback lists

[claymcleod]

When a WDL task specifies an array of container images in its container requirement, each candidate is now tried in order until one pulls successfully. This lets task authors provide fallback images for environments where a preferred registry might not be reachable. The WDL wildcard value * resolves to the configured default container (e.g., ubuntu:latest) at parse time rather than being modeled as a separate enum variant.

The actual container that was used during execution is now tracked via TaskExecutionResult and stored in TaskPostEvaluationData, so downstream consumers always know which image ran—not just which candidates were offered.

Closes #691

Before submitting this PR, please make sure:

For all contributors:

• You have added tests (when appropriate).
• You have added an entry in the CHANGELOG (when appropriate).
• You have updated the README or other documentation to account for these changes (when appropriate).
• You have made a PR to the next branch in the sprocket.bio repository (when appropriate).