Set up remote caching in CI (cherry-pick of pantsbuild#19144)

Runs a sidecar bazel-remote server in a docker container. This server uses S3 as its storage backend, specifically a new cache.pantsbuild.org bucket.

Read/write access requires our AWS secret key, which is not accessible to PRs across forks. So to write to this cache, a PR must be from a branch in the pantsbuild/pants repo.

We can establish protocols by which a set of trusted contributors can push to feature branches in pantsbuild/pants and submit PRs from them, rather than from forks, to get the best CI speedups.

PRs across forks can still read from the cache, via restricted creds.