Set up remote caching in CI (pantsbuild#19144)

Runs a sidecar [bazel-remote](https://github.com/buchgr/bazel-remote/)
server in a docker container. This server uses S3 as its storage backend,
specifically a new cache.pantsbuild.org bucket.

Read/write access requires our AWS secret key, which is not accessible
to PRs across forks. So to write to this cache, a PR must be from
a branch in the pantsbuild/pants repo.

We can establish protocols by which a set of trusted contributors
can push to feature branches in pantsbuild/pants and submit PRs
from them, rather than from forks, to get the best CI speedups.

PRs across forks can still read from the cache, via restricted creds.