Tag all CI jobs requiring docker-in-docker

Adds the appropriate `docker` tag to all CI jobs requiring
docker-in-docker, to ensure they are picked up by privileged runners