fix: ensure eicweb and ghcr oci buildcache are used for fetch too

I noticed we only list the OCI buildcaches as push targets, not fetch/pull targets. It is possible that this has meant that we have been pulling from S3 when we should have been pulling from eicweb.

This PR adds fetch targets to the OCI buildcaches which should lead to eicweb being pulled preferentially.

Note: this also adds an upgrade to Qt because only changing secrets doesn't invalidate layer caches so nothing new is done to test that this works.