ci: Build and publish buildkit variant
Build the buildkit variant on untrusted runners for all merge requests.
Build and publish the buildkit variant on trusted runners for protected tag pushes.
Bug: T319319 Change-Id: I75a53ca255abf61032d63539c043eba12f161b4b