Keep Go's build cache between builds (closes #124)

The Dockerfile runs make test and make build with Go's build cache in a
BuildKit cache mount, so a build compiles only what changed since the
last one instead of the standard library and every dependency from
nothing. The mount has an id of its own, so builds of other repositories,
compiled against other C headers, do not share it. script/test passes
-count=1, so no test result is taken from the cache.

Model: opus-5-5

README.md

@@ -604,7 +604,8 @@ provide:
 - `script/build` — build the `secret` binary into the repo root, stamping the
   version (`VERSION` from the environment, else `git describe`) and the git
   commit
-- `script/test` — run `go vet` and the test suite (verbose rerun on failure)
+- `script/test` — run `go vet` and the test suite (verbose rerun on failure),
+  every test on every run, never a result from Go's test cache
 - `script/lint` — run `golangci-lint` in docker only: builds `Dockerfile.lint`,
   where the linter is a build step that runs on every call, also on an unchanged
   tree
@@ -624,7 +625,8 @@ provide:
 - `script/cibuild` — CI entrypoint: `docker build --ulimit memlock=-1:-1 .`
   (memguard needs mlock; the Dockerfile runs the checks), with a new
   `CHECK_EPOCH` build argument on every run so the checks run again on an
-  unchanged tree
+  unchanged tree; the `Dockerfile` keeps Go's build cache between builds, so
+  `make test` and `make build` compile only what changed
 - `script/precommit` — pre-commit checks: `go mod tidy` verification, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook that runs