Add opendev-intermediate-registry-base

To explain the problem first; I want the system-config-run-paste job
to be able to speculatively test containers from lodgeit project
changes.  lodgeit is building containers, using
opendev-buildset-registry job and seems to be pushing the results of
changes into the Opendev intermediate registry just fine.  However,
the system-config-run-paste job isn't picking up the container when
using Depends-On: <lodgeit-change>.

On the system-config side, there is nothing running
pull-from-intermediate-registry.  So the build artifact container of
the dependent change is never put into the buildset registry and we
always end up pulling the latest upstream image.  I think that in
system-config we are largely consuming containers that are co-built
along-side the testing jobs which is why we have never had this
problem.

Since pull-from-intermediate-registry runs in a trusted context on the
executor, we need it here.  Add a new base job
"opendev-intermediate-registry-base" that jobs can use as a parent
that runs this role.  This would be useful for any jobs that want to
consume containers from other projects via the Opendev intermediate
registry.

Change-Id: I2fa70ed034ca91904a2759811055e98b17e034cd

doc/source/docker-image.rst

@@ -156,6 +156,8 @@ the additional tasks performed by the "upload" and "promote" jobs:
 Jobs
 ----
 
+.. zuul:autojob:: opendev-intermediate-registry-base
+
 .. zuul:autojob:: opendev-buildset-registry
 
 .. zuul:autojob:: opendev-buildset-registry-consumer

zuul.d/jobs.yaml

@@ -141,6 +141,42 @@
           +v5Gg5Wb07OWvBjg0jcL9IvNwQXgWh39y4uq4TmKcYXHL6RnICtN5Hp4Gc7xDxNvp2+uC
           Na/OOailVlvkWMcpO/l77/qFtNXoRxFTDWYqp5rE3fGmdq09hCiflFWgMMre08=
 
+- job:
+    name: opendev-intermediate-registry-base
+    description: |
+      A base job that runs "pull-from-intermediate-registry" to
+      populate the current buildset registry with container artifacts
+      from the Opendev intermediate-registry.
+
+      Use this in jobs that want to speculatively test (i.e. use
+      Depends-On:) containers from other projects that publish to the
+      Opendev intermediate registry.
+
+      For example, project `moo` builds a container image.  It should:
+
+        * specify `provides: moo-container-image` for it's container
+          build job
+        * ensure it pre-runs the opendev-buildset-registry job
+        * use the opendev-build-docker-image jobs below to produce the
+          container
+
+      Changes to `moo` will then push their container images to the
+      Opendev intermediate registry and provide an artifact in their
+      job result.
+
+      If project `foo` then has a job that wishes to speculatively
+      test (via Depend-On:) the `moo` change by using the container it
+      has built, it should:
+
+        * add `requires: moo-container-image`
+        * pre-run opendev-buildset-registry
+        * parent itself to this job.
+
+      This will pull the `moo` container produced by the dependent
+      change from the intermediate archive into the running buildset
+      registry for deployment and testing.
+    pre-run: playbooks/docker-image/pre.yaml
+
 - job:
     name: opendev-buildset-registry
     description: |