Add CA-baked plugin-docker-buildx image + buildah CI

Bake the internal Vault-PKI CA into a rebuild of
woodpeckerci/plugin-docker-buildx so k8s buildx jobs can push to
artifactapi's docker-internal registry over TLS.

- Dockerfile: copy unkin-ca.crt into /etc/docker/certs.d/<registry>/ca.crt
  and the system trust store
- unkin-ca.crt: vault-ca-cert bundle (root + intermediate)
- .woodpecker/build.yaml: PR gate, buildah build-only
- .woodpecker/release.yaml: on v* tag, buildah build + credless push to
  docker-internal with --tls-verify=false (bootstrap)

.woodpecker/build.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+
+steps:
+  # PR gate: build the CA-baked plugin image only, no push. buildah runs
+  # unprivileged in-cluster, so use the vfs storage driver + chroot isolation.
+  - name: build
+    image: quay.io/buildah/stable
+    commands:
+      - buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} .
+    backend_options:
+      kubernetes:
+        serviceAccountName: plugin-docker-buildx
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2