Document advanced use cases for GitLab CI/CD and private container image registries

[0x2b3bfa0]

• AWS instance profiles as per Task secret management terraform-provider-iterative#602 (comment)
• Configuration as part of the workflow variables, as in e.g.

  variables:
    AWS_ACCOUNT: 000000000000
    AWS_DEFAULT_REGION: us-east-1
    AWS_REGISTRY: ${AWS_ACCOUNT}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com
    AWS_CONTAINER_IMAGE: ${AWS_REGISTRY}/example:latest
    DOCKER_AUTH_CONFIG: '{"credHelpers": {"${AWS_REGISTRY}": "ecr-login"}}'
  
  build:
    rules:
      - changes: [Dockerfile, .gitlab-ci.yml]
    services:
      - docker:dind
    image: docker
    script:
      - docker run --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY --env AWS_SESSION_TOKEN --env AWS_DEFAULT_REGION amazon/aws-cli ecr get-login-password |
        docker login --username AWS --password-stdin ${AWS_REGISTRY}
      - docker build --tag ${AWS_CONTAINER_IMAGE} . 
      - docker push ${AWS_CONTAINER_IMAGE}
  
  launch:
    image: iterativeai/cml:0-dvc2-base1
    script: >
      cml runner launch
      --cloud=aws
      --cloud-region=$AWS_DEFAULT_REGION
      --cloud-type=m5.2xlarge    
      --cloud-hdd-size=32
      --labels=cml
  
  train:
    needs: [launch]
    tags: [cml]
    image: ${AWS_CONTAINER_IMAGE}
    script:
      - echo hello world