Restore Docker installation on host machine in setup-docker.sh (#2883)

PR #2821 intended to remove Docker-in-Docker installations from worker
container images, but accidentally also removed Docker from
`buildkite/setup-docker.sh`.

`setup-docker.sh` is the startup script for the host GCE Linux VM that
hosts the Buildkite agent and runs CI jobs in Docker containers. Without
Docker installed on the host, the VM image creation pipeline
(`create-linux-vm-image`) [fails and
hangs](https://buildkite.com/bazel-trusted/create-linux-vm-image/builds/48#01a0ceb7-375d-4ab2-a202-1d7dc31658b7)
with _`"/etc/docker/daemon.json: No such file or directory"`_ error.

This PR restores the Docker installation on the host VM.

TODO: We also need to make sure such problems fail and not just hang
there for hours.

buildkite/setup-docker.sh

diff --git a/buildkite/setup-docker.sh b/buildkite/setup-docker.sh
index 4be0076..2d8acf0 100755
--- a/buildkite/setup-docker.sh
+++ b/buildkite/setup-docker.sh
@@ -102,6 +102,34 @@
   sed -i 's/^::1 .*/::1 localhost ip6-localhost ip6-loopback/' /etc/hosts
 }
 
+### Install Docker.
+{
+  apt-get -y install apt-transport-https ca-certificates
+
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+  echo \
+      "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
+      $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+  apt-get -y update
+  apt-get -y install docker-ce docker-ce-cli containerd.io
+
+  # Allow everyone access to the Docker socket. Usually this would be insane from a security point
+  # of view, but these are untrusted throw-away machines anyway, so the risk is acceptable.
+  mkdir /etc/systemd/system/docker.socket.d
+  cat > /etc/systemd/system/docker.socket.d/override.conf <<'EOF'
+[Socket]
+SocketMode=0666
+EOF
+
+  # Disable the Docker service, as the startup script has to mount /var/lib/docker first.
+  systemctl disable docker
+  systemctl stop docker
+
+  # Add buildkite-agent to the docker group to grant it permissions to the Docker socket
+  usermod -aG docker buildkite-agent
+}
+
 ## Add our minimum uptime enforcer.
 {
   cat > /etc/systemd/system/minimum-uptime.service <<'EOF'