Feature: `cache-poisoning`: treat `docker/build-build-action` as a potential cache source

[woodruffw]

Per pypi/warehouse#17442 (comment) -- right now we have a "publish sink" coordinate for this action when it has push: true, but we should also consider it a "cache source" when it has cache-to: type=gha and equivalent inn it.

This is going to be nontrivial to do, since I'll have to parse that cache-to field and also handle computed values via expressions.

h/t @di