fix(ci): Pin nightly commit in `foundry` for devnet job

Parameterize python binary in Makefile

ci: enable codecov comments for contracts

ci: Notify slack when semgrep or docker publish fails on develop branch

op-e2e: Wait for external clients to terminate after Kill()

Although ideally, all python minor versions (3.x) would be backwards
compatible, unfortunately that is not the case.  Consequently, sometimes
developers will have multiple python builds available on their systems,
not just a single `python3`.  This change simply makes the python binary
name a parameter of the Makefile so that affected developers may pass:

```
PYTHON=python-3.9 make
```

Or similar.

(fix)indexer: add timestamp to op-indexer withdrawals response

Missing envvars setting for --override.canyon flag

op-e2e: Disable cannon tests for external geth

Otherwise the client may write to a directory the test tries to delete causing failures.

Moves choice of running cannon tests to a separate env var rather so it is possible to run cannon tests with HTTP when desired.

op-e2e: Fix race condition with removing included tx from the pool

      Specify that the recognized batch submitter account is stored in the System Configuration.
  

The tx pool updates async, so the list of pending transactions may contain transactions included in a block if the tx pool update hasn't completed.
Filter any transactions with nonces that are too low to avoid this race condition.

op-e2e: Use a short wait for new claim when performing all possible dishonest moves

ci: Configure docker auth before attempting to publish.

The timeout is expected to be reached sometimes because the challenger has chosen not to respond, so we don't want the default long timeout.

Fixes docker-bake build targets for ci-builder and chain-mon

Remove the git tag from the release tags to add and allow the release script to add it instead.

Remove the publish step because all tags are added by the docker buildx step already.

op-e2e: Disable cannon tests when using HTTP instead of WS

ci: Use pipeline.git.tag not pipeline.git.branch when doing releases

Fault dispute tests take longer to execute when polling with HTTP so disable the longer running cannon tests on HTTP.
Cannon itself is unaffected by the connection type and the challenger is tested with HTTP via the alphabet game tests.

contracts-bedrock: fix test legibility
  

Adds a new helper library called `EIP1967Helper` that can
get the admin and impl storage slots from a `Proxy` implementing
ERC1967. This is more helpful to use than hardcoded magic values
such as `multisig` because it is not clear who the multisig is
since its value is assigned in a different file. We want to decouple
the value from a magic value and set it to exactly what we want it
to be which is the admin. This will work in all cases no matter what
the admin is since it dynamically pulls the value from storage for
the tests.

contracts-bedrock: modern import style in tests

ci: Add filters so op-stack-go-docker-build-release builds on tags.