Add .dockerignore to target workflow override

There is an extra layer of protection that code provided by PR
should not be executed in the context of pull_request_target by
running the code only inside docker container. However the
container is build from local sources, so it could contain other
code. We do not allow that by .dockerignore, but the .dockerignore
should not be overrideable from the incoming PR.

.github/actions/checkout_target_commit/action.yml

@@ -65,9 +65,11 @@ runs:
         rm -rfv "dev"
         rm -rfv ".github/actions"
         rm -rfv ".github/workflows"
+        rm -v ".dockerignore" || true
         mv -v "target-airflow/scripts/ci" "scripts"
         mv -v "target-airflow/dev" "."
         mv -v "target-airflow/.github/actions" "target-airflow/.github/workflows" ".github"
+        mv -v "target-airflow/.dockerignore" ".dockerignore" || true
       if: inputs.pull-request-target == 'true' && inputs.is-committer-build != 'true'
       ####################################################################################################
       #  AFTER IT'S SAFE. THE `dev`, `scripts/ci` AND `.github/actions` ARE NOW COMING FROM THE