CI: build per-PR Docker test image on demand via label

Problem

There is no lightweight way to get a runnable Docker image for an open PR. Developers who want to test a branch's image today must trigger the manual deploy workflow (cicd_8-manual-deploy.yml), which pushes to dotcms/dotcms and is a manual, out-of-band step.

Proposal

Add a workflow that builds and pushes a test image automatically for any PR labeled PR: docker image:

• Triggers when the label is applied, or when a new commit is pushed to an already-labeled PR.
• Pushes to dotcms/dotcms-test (kept separate from the official dotcms/dotcms repo).
• Tags with the PR number + a normalized branch name, e.g. branch feat/bedrock-agentic-harness on PR #1234 → dotcms/dotcms-test:pr-1234-feat-bedrock-agentic-harness (plus an immutable ..._<sha> tag).
• Reuses the existing modern build phase (cicd_comp_build-phase.yml) and the deploy-docker composite action.

Notes

• Fork PRs cannot push (no access to DOCKER_* secrets) — internal branches only, by design.
• amd64-only to keep build time reasonable; multi-arch can be added later if needed.

Start by reading cicd_8-manual-deploy.yml, cicd_comp_build-phase.yml, and the deploy-docker composite action to understand the existing workflow and image build inputs. Validate the new workflow for the PR: docker image label and subsequent commits, confirming internal PR images receive the requested repository and PR/branch/SHA tags while fork PRs do not attempt to push.