Refactor build workflow

[ben-harvey]

There were some issues with the existing build workflow:

• the use of kind/k8s seemed overly complicated for just running one docker container for testing
• periodically the workflow timed out either waiting for a pod or waiting for the runner on the pod to register, and the workflow timeout is 6 hours which is too long
• console output from the runner is not visible when run on kind
• the runner test doesn't cover the case when there is already a runner registered to the repo when the test runs (i.e. it doesn't confirm that the job is actually running on the self-hosted runner that the test creates)
• it relies on scheduling a second workflow from a separate file on the test runner

The new approach leverages a few things:

• GitHub runners can run Docker directly
• Different job steps run on separate VMs on the hosted runner
• Labeling and naming a runner lets you query info about and schedule jobs on a specific runner
• You can set timeouts on specific jobs

New steps:

1. Set a UUID that will be used both in setting up the test runner and in scheduling the job on the test runner. This entailed a small change in the script that configures the runner.
2. Build the image (using the GitHub Cache API to set/fetch cached layers) but don't push it yet
3. Run Trivy and Dockle tests on the image
4. Push the image to ECR with only a tag for the commit SHA
5. Run the image, passing in the UUID to name and label the runner (the console output from the runner appears in the workflow logs)
6. In a separate job, poll GitHub until the runner with the UUID is ready. Time out if it takes longer than 10 minutes (average is 4-5 minutes)
7. Once ready, schedule a test job on the runner, specifying the UUID label
8. If the branch is 'main', add the 'latest tag to the ECR image

Actions added:

• docker build-push-action
• this is the official Docker Action that supports the Moby BuildKit. https://github.com/moby/buildkit. The advantage is that we can cache image layers using the GitHub Cache API, which speeds up builds
• ecr-retag-action

Testing:

I ran the workflow a lot and confirmed the pushes/tags in ECR

[crbudzeak]

Great work, LGTM!