[chore](docker)Support rootless Docker for third-party environments - #70457

…h-4.1 (#70578)

### Background

The required status checks of every protected branch come from
`protected_branches` in the `.asf.yaml` on `master`. ASF's asfyaml
service applies that section to GitHub whenever the `github:` block
changes; the copies on release branches have no effect. Since #70459,
PRs into `master`, `branch-4.2` and `branch-4.1` are checked by the new
TeamCity, which reports statuses named `TeamCity/<pipeline>`. External
is the regression lane for external catalogs and their docker fixtures.

### What problem does this PR solve?

Issue Number: None
Related PR: #70459 (introduced the behavior this PR changes), #70457
(must be picked to branch-4.2 and branch-4.1 first)
PR Type: Build/CI/Chore

Problem Summary:

When #70459 renamed the required checks, it left `TeamCity/external`
out, so a red External run no longer blocks merges into `master`,
`branch-4.2` or `branch-4.1`. This PR adds it back to all three lists,
in the slot the old `External Regression (Doris External Regression)`
check had. Merging also makes asfyaml re-apply the whole section, and
GitHub is out of sync with it today: `branch-4.2` still requires the
nine pre-migration names, which new PRs never receive, and `branch-4.1`
and `branch-2.0` have no protection at all.

### Details

- **Affected:** GitHub branch protection only: one more required context
on `master` (17 in total), `branch-4.2` (13) and `branch-4.1` (13). No
workflow, script or TeamCity change: External uses P0's file filter, so
a PR that skips P0 also gets a skipped `TeamCity/external`. Trailing
spaces are dropped from two `branch-4.0` and `branch-3.1` lines, which
changes no value.
- **Developer and release impact:** PRs into the three branches need
`TeamCity/external` green or skipped before they can merge. On
`branch-4.2` and `branch-4.1` its preflight fails today with `Native
rootless support missing; cherry-pick PR70457 before validating this
branch`, so #70457 has to be picked to both branches before this lands,
or every 4.x PR that runs External is blocked. Once protection is
re-applied, `branch-4.1` PRs again need an approval and green required
checks, and `branch-4.2` PRs can merge on the `TeamCity/*` checks they
actually receive.
- **License and third-party:** None.
- **Rollback:** Revert this commit; asfyaml applies the previous lists
again because the `github:` block changes.

### Testing

- `asfyaml-validate` from apache/infrastructure-asfyaml (`e4c2644`), run
locally: the old and the new file are valid, and copies with a
non-integer review count or a mis-indented list item are rejected.
- Both files parsed locally with asfyaml's GitHub schema: the only data
change is `TeamCity/external` in the three `contexts` lists, with the
existing order kept and no duplicates.
- Every name in the new lists is reported on live PRs: all 17 on #70366
(`master`), and all 13 on a recent `branch-4.1` PR.

### Notes for Reviewers

- asfyaml runs only on `master`, after the merge, so whether GitHub
takes the new lists can only be checked then: `gh api
repos/apache/doris/branches/<branch> --jq
.protection.required_status_checks.contexts` for each branch, and
`.protected` for `branch-4.1` and `branch-2.0`. A failed run is mailed
to [email protected] and to whoever merged.
- `TeamCity/performance` stays optional; the comment above the lists now
says only that.