Describe the bug
The Helm OCI artifact gets updated on push to main. This is not good, as releases shouldn't get updated after inital release. I don't think the release actually gets updated with new code, it just gets overwritten (but I could be wrong). In any case, as the digest is updated, CD tools (like Flux) will pull the new artifact and roll out new containers.

In time of writing (1:37pm UTC, May 10th) the 0.16.2 release was updated 9h ago: https://github.com/external-secrets/external-secrets/pkgs/container/charts%2Fexternal-secrets/412444762?tag=0.16.2

Expected behavior
Releases doesn't get updated after inital release.