[CI] Fix Docker action rate limits, hopefully

[infotroph]

Description

Motivation and Context

Review Time Estimate

• [ ] Immediately
• [ ] Within one week
• [ ] When possible

Types of changes

• [ ] Bug fix (non-breaking change which fixes an issue)
• [ ] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• [ ] My change requires a change to the documentation.
• [ ] My name is in the list of CITATION.cff
• [ ] I have updated the CHANGELOG.md.
• [ ] I have updated the documentation accordingly.
• [ ] I have read the CONTRIBUTING document.
• [ ] I have added tests to cover my changes.
• [ ] All new and existing tests passed.

[infotroph]

Questions for @robkooper:

• This change probably requires everyone to use BuildKit/buildx, including for local image builds. Is it safe to assume everyone building locally will have BuildKit available? Should that be documented somewhere?
• I find the mount=type=secret,... export...cat... && ... nonsense in the Dockerfiles to be very hard to read, and I'm worried it will make some users give up on understanding the build steps. Do you have ideas for how to make it more approachable? (Comments? Some kind of indirection to reduce the verbosity?)
• Since the syntax is so verbose, I only passed the token to the RUN steps that actually need to use it to install R packages from GitHub. Would it be more or less confusing to use it everywhere? Do you have other thoughts on how to achieve this securely without making the build steps completely incomprehensible?