Only run docker-dryrun when necessary (#25329)

`docker-dryrun` runs on almost any PR, which is a huge waste of CI
resources. Run it only when the Dockerfiles change and also add a step
that verifies the rootless file.

---------

Co-authored-by: techknowlogick <techknowlogick@gitea.io>

.github/workflows/pull-docker-dryrun.yml

@@ -11,8 +11,8 @@ jobs:
   files-changed:
     uses: ./.github/workflows/files-changed.yml
 
-  docker-dryrun:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
+  regular:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
@@ -21,3 +21,15 @@ jobs:
         with:
           push: false
           tags: gitea/gitea:linux-amd64
+
+  rootless:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/build-push-action@v4
+        with:
+          push: false
+          file: Dockerfile.rootless
+          tags: gitea/gitea:linux-amd64