Set up remote caching in CI (cherry-pick of #19144) (#19162)

Runs a sidecar [bazel-remote](https://github.com/buchgr/bazel-remote/)
server in a docker container. This server uses S3 as its storage
backend, specifically a new cache.pantsbuild.org bucket.

Read/write access requires our AWS secret key, which is not accessible
to PRs across forks. So to write to this cache, a PR must be from a
branch in the pantsbuild/pants repo.

We can establish protocols by which a set of trusted contributors can
push to feature branches in pantsbuild/pants and submit PRs from them,
rather than from forks, to get the best CI speedups.

PRs across forks can still read from the cache, via restricted creds.