Set up remote caching in CI (cherry-pick of #19144) (#19163)

Runs a sidecar bazel-remote server in a docker container. This server
uses S3 as its storage backend, specifically a new cache.pantsbuild.org
bucket.

Read/write access requires our AWS secret key, which is not accessible
to PRs across forks. So to write to this cache, a PR must be from a
branch in the pantsbuild/pants repo.

We can establish protocols by which a set of trusted contributors can
push to feature branches in pantsbuild/pants and submit PRs from them,
rather than from forks, to get the best CI speedups.

PRs across forks can still read from the cache, via restricted creds.