Build the docker image from a ciflow/docker label (#3977)

- Build the tutorials image from a `ciflow/docker` label instead of on
every PR, because fork PRs can't get the AWS token needed to push to
ECR.
- The labeler adds the label when `.ci/docker` changes.

Author: huydhn

.github/labeler.yml

@@ -0,0 +1,5 @@
+"ciflow/docker":
+  globs:
+    - .ci/docker/**
+    - .github/workflows/docker-build.yml
+  draft: false

.github/pytorch-probot.yml

@@ -1 +1,4 @@
 tracking_issue: 1896
+ciflow_push_tags:
+- ciflow/docker
+labeler_config: labeler.yml

.github/workflows/docker-build.yml

@@ -2,16 +2,16 @@ name: Docker Build
 
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - .ci/docker/**
-      - .github/workflows/docker-builds.yml
   push:
     branches:
       - main
+    # A fork PR gets no OIDC token to push to ECR, so a PR opts in with the
+    # ciflow/docker label instead, which pushes this tag from the base repo.
+    tags:
+      - ciflow/docker/*
     paths:
       - .ci/docker/**
-      - .github/workflows/docker-builds.yml
+      - .github/workflows/docker-build.yml
 
 jobs:
   docker-build: