Build idempotency -- dont rebuild when there is no change

[detjensrobert]

Currently we rebuild all docker images and upload challenge assets even if the challenge files have not changed at all. This bit us when we hit the docker.io rate limit for (unauthenticated) pulls (#59). We were usually not actually building the images again because of the docker layer cache, but still.

We should be smarter about this and only rebuild what is necessary. Some ideas as to how to do this:

• compute directory md5 or modified time, store as a container label, and check against existing image label
• we can probably continue to always extract build artifacts from containers
• check artifact file md5 against s3 ETag

[detjensrobert]

Docker pulls only count as pulls if the image was actuall pulled -- version checks to see if a tag updates do not count. We can't really improve over docker's layer caching already, so focus on the S3 side of things.