fix(ci): use PR head SHA instead of merge commit SHA for Docker builds

github.sha in pull_request events is a temporary merge commit that only
exists in GitHub's internal refs (refs/pull/N/merge) and is never pushed
to the repo. Dockerfiles that do `git clone && git checkout ${DSTACK_REV}`
fail with exit 128 because this SHA is unreachable.

Use github.event.pull_request.head.sha for PR events, falling back to
github.sha for push-to-branch events where it is always a real commit.

Author: kvinwang

.github/workflows/docker-build-check.yml

@@ -30,7 +30,7 @@ jobs:
           platforms: linux/amd64
           provenance: false
           build-args: |
-            DSTACK_REV=${{ github.sha }}
+            DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}
             DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
 
       - name: Build KMS contracts
@@ -55,7 +55,7 @@ jobs:
           platforms: linux/amd64
           provenance: false
           build-args: |
-            DSTACK_REV=${{ github.sha }}
+            DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}
 
   verifier:
     runs-on: ubuntu-latest
@@ -74,4 +74,4 @@ jobs:
           platforms: linux/amd64
           provenance: false
           build-args: |
-            DSTACK_REV=${{ github.sha }}
+            DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}