ci: v2 (docker, linting/checks)

This implements the second iteration of our CI pipeline.

There are two main changes in it:

1. We now use a Docker image and Docker runner. The image is still built from Nix, so we still have only one source of truth for project dependencies.
2. We now run a bunch of checks: clang-tidy, clang-format and mypy.

tools/format.sh

+#!/usr/bin/env bash
+set -e -x
+
+find . \
+    -type d \
+    \( \
+        -path './build' -o \
+        -path './recovery/build' -o \
+        -path './components/micropython/vendor' -o \
+        -path './components/tinyusb' -o \
+        -path './components/ctx' -o \
+        -path './sim' \
+    \) -prune \
+    -o \
+    -name '*.[ch]' \
+    -exec clang-format -i \{\} \;