fix leaking of Docker image env var state

the repository fetcher is a long-lived object; the previous code seemed
to assume it existed only for the duration of a single fetch, and thus
env vars were left around between images.

refactored the code to just remove this state, and cleaned up some of
the information flow. rather than maintaining state to track which env
vars should take precedence, a single pass is done at the end to filter
the list.
[fix-env-leak-#79660326]: log and test malformed env vars
Merge branch 'fix-env-leak-#79660326'