Multi-platform caching for buildx

[blampe]

buildkit doesn't support multi-platform caches, so --cache-to with
--platforms can race such that only one platform is cached and subsequent
operations must re-build remaining platforms.

The recommended workaround is to perform a build without --cache-to, and then
perform P additional builds for each platform to push a platform-specific
cache.

We have two choices:

1. We can detect this situation and refuse to build, with an error providing
   guidance for the user. An x86/ARM image would need 3 buildx.Image to
   propertly cache itself. If/when Docker resolves
   Pushing cache to "registry" cache with multi-node builder only uploads cache from one node docker/buildx#1044, users would need to clean up
   their extraneous resources in order to leverage upstream's behavior. In most
   cases this cleanup will simply never happen (assuming most users don't
   closely follow Docker implementation details.)
2. We can detect this situation and automatically apply the workaround for the
   user. Only one buildx.Image is needed. If/when Docker resolves
   Pushing cache to "registry" cache with multi-node builder only uploads cache from one node docker/buildx#1044 we can instead rely on upstream
   behavior without any action needed from the user.

The workaround (option 1) is certainly possible with Pulumi today, however it's
awkward and I would rather not force this complexity on users who expect this
to Just Work™.

So this PR implements the second option. We detect this situation and munge the
build options such that we perform an initial build without --cache-to, and
then we push platform-specific caches. In the registry case we jump through
some hoops to prevent these derived cache keys from getting exposed as tag
names.

[blampe]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• E2E buildx tests #996
• Support inline dockerfiles, named and remote contexts #1000
• API types for caches, exports, and platforms #993
• Multi-platform caching for buildx #981 👈
• Handle unknown inputs and buildOnPreview #980
• Share build context hashing #962
• buildx auth #948
• buildx.Image MVP #899
• Upgrade Docker SDK #898
• Initial go-provider integration #890
• feature/buildkit

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @blampe and the rest of your teammates on Graphite

[github-actions]

Does the PR have any schema changes?

Does the PR have any schema changes?

Looking good! No breaking changes found.

New resources:

• buildx/image.Image

Maintainer note: consult the runbook for dealing with any breaking changes.