[workflow] Build once and run tests against multiple Kubo versions

[manandbytes]

[cstamas]

While I like this PR overall, I have one problem with it: use of external action: hoverkraft-tech/compose-action. In general I try to avoid these, but if I have to use them, I like to lock them down by hash, as GH had issues with other approaches. I do trust GH or my own actions, but not third party (for unwanted changes creeping in).

[cstamas]

In general I avoid third party actions, but if they are needed, use them with most caution and lock them down with hashes.