refactor dockerfile & docker build process

[syphar]

• Build all Docker images together using Buildx Bake.
• Improve dependency and incremental build caching across CI runs and for local development
• Share common Dockerfile stages between image targets.
• only apt install what is actually needed by each stage.
• Build only the binary required by each image.
• Smoke-test every packaged binary in CI.
• don't build/copy the legacy cratesfyi binary any more, we'll definitely not use it in the new infra.
• move GIT_SHA docker arg into the binary build stages, so the chef dependency layer isn't invalidated for each new commit.

I think this is now a good balance between CI docker build time, and local incremental docker build time. I imagine having had this on my old mac would have made my life much easier.

[syphar]

r? @GuillaumeGomez

[rustbot]

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.