CI: pull pipelines Docker images from AWS ECR

CI improvement

We are now mirroring the opam-repository Docker image from registry.gitlab.com to 609325257694.dkr.ecr.us-east-1.amazonaws.com

Example with the current one, sha1 845375388d477153b36344f69a23a1b34b2bf82e:

https://gitlab.com/tezos/opam-repository/-/jobs/2412844080 => registry.gitlab.com/tezos/opam-repository:runtime-build-test-dependencies--845375388d477153b36344f69a23a1b34b2bf82e has been cloned to 609325257694.dkr.ecr.us-east-1.amazonaws.com/tezos/opam-repository:runtime-build-test-dependencies--845375388d477153b36344f69a23a1b34b2bf82e.

https://gitlab.com/nomadic-labs/tezos and https://gitlab.com/tezos/tezos will have CI_REGISTRY set with 609325257694.dkr.ecr.us-east-1.amazonaws.com (private AWS ECR). If you do not want to switch to AWS ECR, CI_REGISTRY should not be used and registry.gitlab.com explicitly hardcoded instead.

If someone forks the repository, the environment variable CI_REGISTRY will not be overridden and will be set by default back to registry.gitlab.com by GitLab.

Testing

CI_REGISTRY explicitly set to 609325257694.dkr.ecr.us-east-1.amazonaws.com https://gitlab.com/tezos/tezos/-/pipelines/535524697

Bonus

We will save money on the AWS bandwidth bill 💸, https://gitlab.com is hosted in Google Cloud

Source: https://about.gitlab.com/handbook/engineering/infrastructure/production/architecture/