CI: build the UCX spcx plugin in the verification container (#2064)

## What?

Wire `--build-ucx-spcx-plugin` into `nixl-ci-build-container` (the
standalone verification container job — despite the name, it never runs
in the PR CI path).

- `contrib/Dockerfile`: new `ARG BUILD_UCX_SPCX_PLUGIN=false` + plugin
build block, ported from `Dockerfile.manylinux`. Adapted RHEL/lib64 ->
Ubuntu/lib: `flexio-sdk` + `dpacc` come from the DOCA 3.3 repo already
configured in the image as debs rather than rpms, and the plugin
installs into `$UCX_PLUGIN_DIR` via `--libdir=$UCX_PREFIX/lib`. Placed
after `COPY . /workspace/nixl`, since `build-container.sh` drops the
plugin source into the build context.
- `contrib/build-container.sh`: the dockerfile guard now greps the
target for the ARG instead of matching paths, so it stays correct as
dockerfiles are added and cannot silently no-op on one that ignores the
flag.
- `build-container-matrix.yaml`: bind `svc-nixl-gitlab-token` +
`ucx-plugin-gitlab-url` on the Build NIXL step, pass `SPCX_FLAG`, and
surface the setting in the repro hint and result mail.
- `proj-jjb.yaml`: new `BUILD_UCX_SPCX_PLUGIN` param, default on
(matching #1912).
- `BUILD_NIXL_EP`: defaulted to `false` while `build-container.sh`
defaults it to `true` with no off-switch, so the job advertised a toggle
that never disabled EP. Default it to `true` and say so in the
description.

## Why?

The verification containers were not updated when spcx plugin support
landed (#1918). The flag was wired only into the manylinux/wheel path,
and `build-container.sh` hard-errored for any other dockerfile — so the
images this job publishes ship without the plugin. The wheel-based LLM
verification containers (`nixl-ci-build-llm-container`) need no change:
they `pip install` release wheels that already bundle the plugin.

## How?

Gated on `ARG BUILD_UCX_SPCX_PLUGIN=false`, so the default build and the
per-PR `nixl-ci-build-container-pr` job are unchanged. `Build NIXLBench`
is untouched — it goes through `benchmark/nixlbench/contrib/build.sh`.
Infinia DDN is deliberately left out of scope.

Two things need a real build to confirm: the `flexio-sdk` / `dpacc` deb
names (extrapolated from the rpm names), and whether the plugin's DPA
transport builds on aarch64 — if FlexIO/dpacc support is x86-only there,
the flag will need per-arch gating.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for building and installing the UCX SPCX plugin in
supported container and wheel builds.
  * NIXL endpoint builds are now enabled by default.
  * Added controls for enabling or disabling SPCX plugin builds.

* **Documentation**
* Updated build instructions, configuration descriptions, credential
requirements, and manual reproduction guidance.
* Clarified plugin installation and bundling behavior across supported
build types.

* **Improvements**
  * Build notifications now report SPCX plugin status.
  * Added validation for SPCX plugin-compatible build configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: NirWolfer <nwolfer@nvidia.com>