ci: building Docker images on dedicated shared runners
The site-local caching system currently used by many shared runners on foss.heptapod.net does not behave well with image pushes (see foss.heptapod.net#94).
Some runners have been set up that don't use such caching, bearing with
the container-registry-push
tag.
This also means that Kaniko doesn't need to use the Heptapod Internal Tooling CA.