It's easy enough to install ci-fairy via pip from git, but doing so requires
an image that's capable of pip. This again means either alpine from
docker (it's small but we'll be ratelimited very soon), or some other image
that each project generates on its own.

Let's assume that several projects have common requirements for a small
reusable image: either basic git checks, python+pip (e.g. flake8 checks) or
ci-fairy. And that we don't want to run afoul docker hub's pull limits, so
we have a need to host this image locally.

This patch adds it as the .fdo.ci-fairy template to every
distribution-specific template. This is just for convenience, the image
itself is always the same and not based on that distribution. So where any
template is included, ci-fairy can be used like this:

   check-mr:
     extends:
       - .fdo.ci-fairy
     script:
      - ci-fairy check-merge-request --require-allow-collaboration

The image itself is built in two stages:
- a private base image with the required packages installed
- the actual public image with ci-fairy pip-installed

The tag for the public image is the sha256sum of the ci_fairy.py file. This
way we only rebuild the image when the source itself changes and new images
are tiny as the base layer is deduplicated across images.

The .fdo.ci-fairy template hardcodes that sha, so projects will keep
pulling the same image until they bump the ci-templates ref.

And now that we're shipping an image, let's set FDO_UPSTREAM_REPO.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>