Prepare Docker images builds

[AlekSi]

Closes FerretDB/FerretDB#4725.

PR Overview

This PR aims to build Docker images for both development and production environments as part of the FerretDB packaging process.

• Introduces several new GitHub Actions workflow steps to initialize the Docker builder and build/push Docker images.
• Updates the BuildKit configuration by disabling garbage collection in ferretdb_packaging/buildkitd.toml.

Reviewed Changes

File	Description
.github/workflows/ferretdb_packages.yml	New steps added for initializing the Docker builder and for building/pushing Docker images.
ferretdb_packaging/buildkitd.toml	Disables garbage collection for both OCI and containerd workers.

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

.github/workflows/ferretdb_packages.yml:209

• [nitpick] The environment variable 'FILE' is quite generic; consider renaming it to a more descriptive identifier (e.g., IMAGE_TYPE or DOCKER_IMAGE_FLAVOR) for better clarity.

FILE=development

To fix the problem, we need to ensure that the downloaded artifact is extracted to a temporary directory and not directly into the workspace. This will prevent any potential malicious files from overriding existing files in the workspace. Additionally, we should verify the contents of the artifact before using it.

• Create a temporary directory for extracting the artifact.
• Modify the actions/download-artifact step to extract the artifact to the temporary directory.
• Verify the contents of the artifact before proceeding with the subsequent steps.

To fix the problem, we need to ensure that the downloaded artifact is extracted to a temporary directory and not directly into the workspace. This will prevent any potential malicious files from overriding existing files in the workspace. Additionally, we should verify the contents of the artifact before using them in subsequent steps.

• Create a temporary directory for extracting the artifact.
• Modify the actions/download-artifact@v4 step to extract the artifact to the temporary directory.
• Verify the contents of the artifact before using them.

To fix the artifact poisoning issue, we need to ensure that the downloaded artifacts are extracted to a temporary directory rather than the workspace. This prevents any potential overwriting of existing files. Additionally, we should verify the contents of the artifacts before using them.

1. Create a temporary directory for extracting the artifacts.
2. Modify the actions/download-artifact@v4 step to extract the artifacts to this temporary directory.
3. Verify the contents of the artifacts before proceeding with any further steps.

To fix the problem, we need to ensure that the contents of the downloaded artifact are extracted to a temporary directory rather than the runner workspace. This will prevent any potential overriding of existing files by untrusted artifact contents. Specifically, we will create a temporary directory using ${{ runner.temp }}/artifacts/ and extract the artifact there. This change will be made in the .github/workflows/ferretdb_packages.yml file.

To fix the problem, we need to ensure that the downloaded artifacts are treated as untrusted and are extracted to a temporary directory. Additionally, we should verify the contents of the artifacts before using them in subsequent steps. This can be achieved by creating a temporary directory for the artifacts and updating the workflow to extract the artifacts there.

1. Create a temporary directory for the artifacts.
2. Update the actions/download-artifact step to extract the artifacts to the temporary directory.
3. Verify the contents of the artifacts before using them.