Scaffold build repo for pinned tailscale/go-cache-plugin

Upstream publishes no releases, so CI has nothing to curl.

- pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
- build a static stripped binary with make build
- test the built binary: static ELF, pinned provenance, and a real
  go build driven through it as a GOCACHEPROG against a stub S3
- add PR build/test/pre-commit workflows and a tag release workflow
  attaching linux/amd64 and linux/arm64 to a Gitea release

.gitignore

@@ -0,0 +1,3 @@
+dist/
+/go-cache-plugin
+/go-cache-plugin-*