automatic release detection: handle empty RELEASE

It has been discovered (!346 (comment 475336)) that my MR for automatic release detection (!346 (merged)) breaks the pipeline iff it is manually triggered with the RELEASE variable set to an empty value (in which case the empty RELEASE would override the autodetected release, leading to bogus image names)

This MR attempts to fix this: since any manually set variable takes precedence over generated variables, we introduce a proxy variable (release) which is set from the user-facing RELEASE (if non-empty) resp d/changelog.

this MR also splits the code into two parts:

• detecting the target release from d/changelog (which we only need to do once, in the provisioning stage)
• pushing the release variable to the follow-up jobs (which we need to do for all jobs that produce artifacts used in other jobs)

while being there, i also

• updated the README to mention that the RELEASE is automatically populated (it said that 'unstable' is used if not set manually)
• updated the description of the RELEASE variable to mention that this variable should be unset (rather than empty) (while it now works with the variable being empty, the new wording is not wrong and in general works nicer :-))

i note that vars/kali.yml contains:

variables:
  RELEASE: 'kali-dev'

which means (i think) that manually triggered pipelines for kali (without removing the RELEASE variable) will not automatically pick up the correct release. I'm leaving it to the kali-devs, whether this is desired behaviour or not.