update the ziti-tunnel container image

[qrkourier]

The ziti-edge-tunnel container image behaviors and ergonomics have been significantly improved over time. Change the ziti-tunnel image to match. For example, enable getting the enrollment token or identity from an env var.

This is important because ziti-tunnel is the only tunneler that can:

1. provide interception for a container's network namespace, and
2. can be configured with only a token (does not require orchestration of a router config)