Duo Workflow Executor binary download should be cached in CI

Problem

Right now our CI jobs always download the binary at https://gitlab.com/gitlab-org/gitlab/-/blob/af7b21a4b560baaaadecdea5cb4a29d9b418615a/ee/app/services/ai/duo_workflows/start_workflow_service.rb#L86 for every CI run. This is very inefficient and is costing us egress traffic and slowing down workflows.

Solution

Somehow cache this binary. Ideally we'd cache this binary in the runner somehow. This might also relate to gitlab-org/duo-workflow/duo-workflow-executor#71 (moved) especially in the idea about bundling the binary in with the runner. Also see gitlab-com/content-sites/handbook!13888 (comment 2549676365) about how step runner distributes binaries today.