Leave out of the build context what the app's .dockerignore names (closes #274)

Docker does not apply .dockerignore to a build context sent as a tar,
so upaas sent every file in the clone. The build now reads the ignore
file as docker build does, <Dockerfile>.dockerignore next to the
Dockerfile if there is one, otherwise .dockerignore at the root, with
the ignorefile reader of moby/patternmatcher, and passes its patterns
as exclude patterns. As the docker command line does, the Dockerfile
and .dockerignore are never left out. An ignore file that cannot be
read, or a malformed pattern, fails the build.

Model: opus-5-5

internal/docker/client.go

@@ -659,8 +659,16 @@ func (c *Client) performBuild(
 		)
 	}
 
-	// Create tar archive of build context
-	tarArchive, err := archive.TarWithOptions(opts.ContextDir, &archive.TarOptions{})
+	// Docker does not apply the app's .dockerignore to a build context sent
+	// as a tar, so leave out the files it names here, as docker build does.
+	excludes, err := readDockerignore(opts.ContextDir, opts.DockerfilePath)
+	if err != nil {
+		return "", fmt.Errorf("failed to create build context: %w", err)
+	}
+
+	tarArchive, err := archive.TarWithOptions(opts.ContextDir, &archive.TarOptions{
+		ExcludePatterns: excludes,
+	})
 	if err != nil {
 		return "", fmt.Errorf("failed to create build context: %w", err)
 	}