perf: improve build cache reuse and PR-safe pushes

[beriberikix]

Summary

Improves CI build speed and cache hit rates, and fixes the workflow so images are not pushed on pull request runs.

Changes

CI (publish.yml)

• Add cache-from/cache-to (GitHub Actions cache) with per-image scopes for base, arch, llvm, and posix jobs
• Narrow build context per job (./zephyr-base, ./zephyr, ./zephyr-posix) to reduce context upload size and cache churn
• Restore PR guard: registry login and image push now only happen on main branch pushes, not on pull requests

Dockerfiles

• Add # syntax=docker/dockerfile:1.7 to all three images to enable BuildKit cache mount syntax
• Add --mount=type=cache for apt and pip in zephyr-base/Dockerfile, keeping package indexes and pip wheels cached across rebuilds without bloating image layers
• Move Python + West install before the SDK download layer in zephyr-base/Dockerfile so a ZEPHYR_SDK_VERSION bump only invalidates the SDK layer, not Python
• Remove redundant apt-get update + install/remove cycles in zephyr/Dockerfile and zephyr-posix/Dockerfile (setup.sh does not require wget/xz-utils to be freshly installed by the derived image — they are available from the base)
• Align ZEPHYR_SDK_VERSION default in zephyr-posix/Dockerfile to 1.0.0

.dockerignore

• Exclude .git, .github, README.md, and LICENSE from the build context

Testing

All three images built and verified locally:

• zephyr:base-1.0.0SDK (arm64)
• zephyr:arm-1.0.0SDK (arm64)
• zephyr:posix-1.0.0SDK (amd64 — gcc-multilib is amd64-only, matches CI)