fix(ci): Pin nightly commit in `foundry` for devnet job

Parameterize python binary in Makefile

ci: enable codecov comments for contracts

ci: Notify slack when semgrep or docker publish fails on develop branch

op-e2e: Wait for external clients to terminate after Kill()

Although ideally, all python minor versions (3.x) would be backwards
compatible, unfortunately that is not the case.  Consequently, sometimes
developers will have multiple python builds available on their systems,
not just a single `python3`.  This change simply makes the python binary
name a parameter of the Makefile so that affected developers may pass:

```
PYTHON=python-3.9 make
```

Or similar.

(fix)indexer: add timestamp to op-indexer withdrawals response

Missing envvars setting for --override.canyon flag

op-e2e: Disable cannon tests for external geth

Otherwise the client may write to a directory the test tries to delete causing failures.

Moves choice of running cannon tests to a separate env var rather so it is possible to run cannon tests with HTTP when desired.

op-e2e: Fix race condition with removing included tx from the pool

      Specify that the recognized batch submitter account is stored in the System Configuration.
  

The tx pool updates async, so the list of pending transactions may contain transactions included in a block if the tx pool update hasn't completed.
Filter any transactions with nonces that are too low to avoid this race condition.

op-e2e: Use a short wait for new claim when performing all possible dishonest moves

ci: Configure docker auth before attempting to publish.

The timeout is expected to be reached sometimes because the challenger has chosen not to respond, so we don't want the default long timeout.

Fixes docker-bake build targets for ci-builder and chain-mon

Remove the git tag from the release tags to add and allow the release script to add it instead.

Remove the publish step because all tags are added by the docker buildx step already.

op-e2e: Disable cannon tests when using HTTP instead of WS

ci: Use pipeline.git.tag not pipeline.git.branch when doing releases

Fault dispute tests take longer to execute when polling with HTTP so disable the longer running cannon tests on HTTP.
Cannon itself is unaffected by the connection type and the challenger is tested with HTTP via the alphabet game tests.

contracts-bedrock: fix test legibility