ci: Rotate Docker cache keys

[hebasto]

This is an alternative to #1807 that avoids introducing a new workflow with the write permissions.

Closes #1691.

The 4-week rotation interval was chosen based on the following rationale:

My thinking is that we may want to take only every fourth one. I assume this is still good enough to catch changes introduced by new compiler optimizations, and this is what we care about.

We could just take the ISO week number mod 4. That results in an off-by-one error after every (rare) year with 53 ISO weeks, but ok, who cares... And if the cache is evicted for whatever other reason, we'll also get the most recent snapshot, but also that seems acceptable.

---

IMPORTANT NOTE: Due to a mere coincidence, LLVM apt signatures became rejected by Debian Trixie today. A commit containing a temporary workaround has been included to address this.

[real-or-random]

What a sad thing to commit in this repo...

(Nothing to do here. I just wanted to point that out.)

[real-or-random]

The pace of the rotation of cache keys is synchronized with the announcements of new GCC snapshots.

I'm not sure if we should take every snapshot. If we take only some snapshots, this will reduce the number of times we need to deal with random GCC breakage.

My thinking is that we may want to take only every fourth one. I assume this is still good enough to catch changes introduced by new compiler optimizations, and this is what we care about.

We could just take the ISO week number mod 4. That results in an off-by-one error after every (rare) year with 53 ISO weeks, but ok, who cares... And if the cache is evicted for whatever other reason, we'll also get the most recent snapshot, but also that seems acceptable.

[hebasto]

The pace of the rotation of cache keys is synchronized with the announcements of new GCC snapshots.

I'm not sure if we should take every snapshot. If we take only some snapshots, this will reduce the number of times we need to deal with random GCC breakage.

My thinking is that we may want to take only every fourth one. I assume this is still good enough to catch changes introduced by new compiler optimizations, and this is what we care about.

We could just take the ISO week number mod 4. That results in an off-by-one error after every (rare) year with 53 ISO weeks, but ok, who cares... And if the cache is evicted for whatever other reason, we'll also get the most recent snapshot, but also that seems acceptable.

Thanks! Reworked.

[real-or-random]

ACK 2ccff6e

[real-or-random]

Let me merge this right now because it contains the LLVM workaround that fixes CI...

We can always adjust or revert if there are further comments, or if people have other opinions on how often we should rotate.