Add workflow to mirror official lighthouse image to ECR

[felixll3]

Summary

• New manually-triggered (workflow_dispatch) workflow sync-official-image-to-ecr that pulls an official lighthouse image (e.g. sigp/lighthouse:vX.Y.Z) and pushes it to 553885929720.dkr.ecr.us-east-1.amazonaws.com/lighthouse.
• No source build — just pull/tag/push, since we don't need to rebuild lighthouse ourselves, only mirror an already-published official release into our own ECR.
• Runs on a GitHub-hosted runner (ubuntu-22.04), not self-hosted — this repo is public, and the org's self-hosted runner groups (Prod/QA) don't allow public repos.

Still needed before this can run

This repo currently has no AWS credentials configured. The workflow expects:

• secrets.AWS_ACCESS_KEY_ID
• secrets.AWS_SECRET_ACCESS_KEY

with ecr:GetAuthorizationToken + push permissions on 553885929720.dkr.ecr.us-east-1.amazonaws.com/lighthouse. Someone with access to that account needs to add these as repo (or org, scoped to this repo) secrets. OIDC role assumption would be the more durable alternative to static keys, but needs a trust-policy change on the AWS side first.

Test plan

• Add AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY secrets with ECR push access
• Run workflow manually with source_image=sigp/lighthouse:<version>, ecr_tag=<version>
• Confirm image appears in ECR