ci: promote frontend workflow

[crazy-max]

This pull request adds a new GitHub Actions workflow that promotes Dockerfile frontend images from docker/dockerfile-upstream to docker/dockerfile. Currently, we use an internal Jenkins pipeline for this task, which is not really transparent and adds some confusion for the consumer. This GitHub Actions workflow will improve visibility and simplify the promotion process.

We can use the Buildx imagetools create command to do this as it now creates new multi-platform images even if the source subimages are located on different repositories or registries: docker/buildx#1137

I have tested the new workflow by triggering it manually: https://github.com/crazy-max/buildkit/actions/runs/4201145135/jobs/7287861587#step:4:23

[crazy-max]

Atm it will just promote a specific tag so you need to run the workflow for each of them (e.g., 1.5.2, 1.5, 1, latest). We could improve this in a follow-up so 1.5.2 would promote subtags and labs channel too like:

# tag     1.5
# result  docker/dockerfile-upstream:1.5        > docker/dockerfile:1.5
#         docker/dockerfile-upstream:1.5-labs   > docker/dockerfile:1.5-labs
#
# tag     1.5
# latest  true
# result  docker/dockerfile-upstream:1.5        > docker/dockerfile:1.5
#         docker/dockerfile-upstream:latest     > docker/dockerfile:latest
#         docker/dockerfile-upstream:1.5-labs   > docker/dockerfile:1.5-labs
#         docker/dockerfile-upstream:labs       > docker/dockerfile:labs
#
# tag     1.5.2
# subtags true
# latest  true
# result  docker/dockerfile-upstream:1.5.2      > docker/dockerfile:1.5.2
#         docker/dockerfile-upstream:1.5        > docker/dockerfile:1.5
#         docker/dockerfile-upstream:1          > docker/dockerfile:1
#         docker/dockerfile-upstream:latest     > docker/dockerfile:latest
#         docker/dockerfile-upstream:1.5.2-labs > docker/dockerfile:1.5.2-labs
#         docker/dockerfile-upstream:1.5-labs   > docker/dockerfile:1.5-labs
#         docker/dockerfile-upstream:1-labs     > docker/dockerfile:1-labs
#         docker/dockerfile-upstream:labs       > docker/dockerfile:labs

[tonistiigi]

Let's keep this internal for now. We don't have tokens with permissions to docker/dockerfile available in GHA atm.