Add a push input to the multi-arch build workflow

The shared docker-build-multi-arch.yaml workflow always pushes the
built image. It has no way to run a build-only check on a pull
request.

lago-self-billing needs that check: its own build must validate
both architectures on a pull request, but must not push to ECR
until the pull request merges. No caller of this workflow does
that today.

Add a push input, default true. Skip the push in the build step
and skip the merge job when push is false. Every current caller
omits this input, so the default keeps their build the same.

Part of the arm64 image-coverage audit in INF-366.

Author: koikonom

.github/workflows/docker-build-multi-arch.yaml

@@ -81,6 +81,12 @@ on:
         type: string
         default: ''
 
+      push:
+        description: 'Push the built image(s) to the registry. Set false for PR-only validation builds.'
+        required: false
+        type: boolean
+        default: true
+
     secrets:
       registry-user:
         description: 'Registry username or AWS Access Key ID'
@@ -277,7 +283,7 @@ jobs:
           platforms: linux/${{ matrix.arch }}
           build-args: ${{ inputs.build-args }}
           secrets: ${{ secrets.build-secrets }}
-          outputs: type=image,name=${{ inputs.image-name }},push-by-digest=true,name-canonical=true,push=true
+          outputs: type=image,name=${{ inputs.image-name }},push-by-digest=true,name-canonical=true,push=${{ inputs.push }}
           cache-from: ${{ inputs.cache-type != 'disabled' && format('type=registry,ref={0}:buildcache-{1}', inputs.image-name, matrix.arch) || '' }}
           cache-to: ${{ inputs.cache-type != 'disabled' && format('type=registry,ref={0}:buildcache-{1},mode=max', inputs.image-name, matrix.arch) || '' }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -299,6 +305,7 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     needs: [build]
+    if: ${{ inputs.push }}
     outputs:
       image-tag: ${{ steps.summary.outputs.image-tag }}
       digest: ${{ steps.inspect.outputs.digest }}