Pin a specific version of the image

[mikibonacci]

We should pin a specific version for the AiiDAlab (or QE app) image we deploy on the demo server. As pointed out by @giovannipizzi, in this way we can safely deploy the latest image of the app without the risk of propagating potential issues in the server.

Now we do this:

singleuser:
        image:
            name: aiidalab/qe
            tag: latest
            pullPolicy: Always

we should pin:

singleuser:
        image:
            name: aiidalab/qe
            tag: {{ environ('TAG') }}
            pullPolicy: Always

also, maybe we can then put the pullPolicy to be IfNotPresent instead of Always, as maybe it can save startup time. We do not need to check the digest then (as now currently done using the Always policy), but only the tag name.