ci: Build a CI image with the toolchain and system packages

[mangas]

Adds a workflow that builds an image graph-node's CI jobs can run in, so jobs stop installing system packages on every run.

• .github/ci-image/Dockerfile: rust:<RUST_VERSION>-slim plus only what the builds need:

  Package	Needed for
  git	actions/checkout inside a container
  lld	RUSTFLAGS: -C link-arg=-fuse-ld=lld
  make, perl	building OpenSSL, which store/postgres pulls in as vendored
  pkg-config, libpq-dev	builds without gnd, whose pq-sys bundled feature otherwise supplies libpq
  protobuf-compiler, libprotobuf-dev	protoc, plus the google/protobuf well-known types that the firehose and ethereum protos import

• .github/workflows/ci-image.yml: builds amd64 and arm64 and pushes ghcr.io/graphprotocol/graph-node-ci:<RUST_VERSION>-<REVISION>. It runs on pushes to master that touch the image files, or on manual dispatch.

• RUST_VERSION (1.94.0) must match rust-toolchain.toml. A rebuild overwrites the tag, so a change that must not replace an image in use bumps REVISION.

No CI job uses the image yet. Switching a job to it means adding container: ghcr.io/graphprotocol/graph-node-ci:1.94.0-1, which can happen in a follow-up once the image is published. An integration-test job running in a container would also need socat, to forward localhost:3011 and localhost:3001 to the service containers.

Open question: nothing ties RUST_VERSION to rust-toolchain.toml other than a comment.

[mangas]

Closing: CI jobs on the current runners only install lld and protobuf-compiler (~20-40s per job), so a prebuilt image would save little while adding an image pull per job, a manual RUST_VERSION sync on every toolchain bump, and container networking changes for the integration tests.