feat!: serve the actions cache from the runner (#1229)

Make cache requests go through the runner and remove outbound traffic from the cache server. The runner forwards them to `cache.external_server` when one is set, and attaches itself to each job network so jobs can reach it.

Benefits:

1. Jobs need no http proxy rules for the cache server, which `@actions/http-client` mishandles for CIDR ranges in `no_proxy` (https://github.com/actions/toolkit/pull/2495).
2. Only runners reach a shared cache server, which needs no route to Gitea.
3. A runner container sharing the host Docker socket now caches, where jobs previously could not reach it.

Breaks:

1. Jobs that reach `external_server` but not their runner, such as a remote `DOCKER_HOST`. The built-in cache has always needed that reachability, so both modes now agree. Set `cache.host` and `cache.port` to an address those jobs reach.
2. Jobs on `container.network: bridge`, where Docker rejects the alias, so the runner cannot attach and their cache fails as it does today. Leave `container.network` empty, or name a user-defined network.

*Written by Claude.*

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1229
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/pkg/config/config.example.yaml

@@ -148,19 +148,12 @@ cache:
   #dir: ""
   # Outbound IP or hostname that job containers use to reach this runner's cache server.
   # Leave empty to detect automatically. 0.0.0.0 is not valid here.
-  # If the runner itself runs in Docker, automatic detection can choose an
-  # address on the runner container's network that job containers cannot reach
-  # when the runner creates a separate per-job network. In that case, set this
-  # to a hostname/IP reachable from job containers, and set port to a fixed
-  # published port or put the job containers on a shared Docker network.
-  # Ignored when external_server is set.
+  # A runner container on the jobs' Docker daemon attaches to each job network automatically.
   #host: ""
   # Port for the built-in cache server. 0 picks a random free port.
-  # Ignored when external_server is set.
   #port: 0
-  # URL of a shared `gitea-runner cache-server` to use instead of starting a local one.
+  # URL of a shared `gitea-runner cache-server` to forward cache calls to.
   # Set on every runner that should share a cache pool. A trailing slash is optional.
-  # Jobs reach the server at this URL too, so set it to the reverse proxy when one fronts the server.
   # Example: "http://cache-host:8088/"
   # Requires external_secret (below) to match the value on the cache-server.
   #external_server: ""
@@ -181,7 +174,7 @@ cache:
   # they do not take for GitHub, so reaching it means editing that check out of their own bundle,
   # put back after the copy into the job. That edit is made either way, this only governs the API
   # advertised. A bundle that does not match is left alone. With v2, artifact uploads go via the
-  # cache server unless container jobs cannot reach its Docker network.
+  # cache server.
   #v2: true
   # How the cache server discards entries, ignored when external_server is set since that
   # server applies its own. Leave a setting out for its default; 0s or 0 turns the three
@@ -201,9 +194,8 @@ cache:
 container:
   # Specifies the network to which the container will connect.
   # Could be host, bridge or the name of a custom network.
+  # A runner container outside bridge cannot join it, so jobs on bridge cannot reach its cache.
   # If it's empty, runner will create a network automatically.
-  # For dockerized runners using the built-in cache server, a custom shared
-  # network can be required so job containers can reach cache.host/cache.port.
   # Deprecated: `network_mode` is still accepted for old configs; use `network` instead.
   #network: ""
   # network_create_options only apply when `network` is left empty and the runner