ci: v2 (docker, linting/checks)

This implements the second iteration of our CI pipeline.

There are two main changes in it:

1. We now use a Docker image and Docker runner. The image is still built from Nix, so we still have only one source of truth for project dependencies.
2. We now run a bunch of checks: clang-tidy, clang-format and mypy.