ci: add prebuilt ci-caddy-builder image

Fourth image in the ci-* family (alongside ci-ansible, ci-k8s,
ci-tofu). Bakes the Go toolchain (golang:1.26 base) plus xcaddy
pinned to v0.4.5 so the build-caddy pipeline doesn't have to
`go install ...@latest` on every run.

build-ci-images.yml gains a build-caddy-builder step that mirrors
the existing three (kaniko, parallel, pull-through-cached registry,
date + latest tags pushed to gitea.renner.uno/gitea_admin/).

The build-caddy.yml consumer swap is a separate commit so it can
land after the first build-ci-images run produces the image.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -72,3 +72,25 @@ steps:
           --insecure-registry registry-mirror.srv.renner.uno:5000 \
           --destination gitea.renner.uno/gitea_admin/ci-tofu:$TAG \
           --destination gitea.renner.uno/gitea_admin/ci-tofu:latest
+
+  - name: build-caddy-builder
+    image: gcr.io/kaniko-project/executor:v1.23.2-debug
+    directory: ci/images/caddy-builder
+    depends_on: []
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --registry-mirror registry-mirror.srv.renner.uno:5000 \
+          --insecure-registry registry-mirror.srv.renner.uno:5000 \
+          --destination gitea.renner.uno/gitea_admin/ci-caddy-builder:$TAG \
+          --destination gitea.renner.uno/gitea_admin/ci-caddy-builder:latest

ci/images/caddy-builder/Containerfile

@@ -0,0 +1,5 @@
+FROM golang:1.26
+
+ARG XCADDY_VERSION=v0.4.5
+
+RUN go install github.com/caddyserver/xcaddy/cmd/xcaddy@${XCADDY_VERSION}