- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the
workflow level. The codespace image publish workflow additionally needs
packages: write to push to ghcr.io.
- Add GitHub action to test docker builds for internal/external PR's
- This PR builds the image on both amd64 and arm64 runners for every PR
- This also reduces the build time by 70% (50mins to 15mins)