[CI] Split the sanitizer leg from the Ubuntu packaging leg (#7666)

The sanitize leg re-ran the Release packaging build after the instrumented
one, so 18 minutes of Release compile queued behind the sanitizer run in a
single job. Give sanitize its own leg with its own image and ccache, and
keep the plain Ubuntu leg publishing the DEB.

- The coverage leg's packaging comment now points at the leg that actually
  publishes the DEB.
- The -DENABLE_SANITIZERS=OFF comment no longer describes a debug-sanitize
  then release-package sequence that no job runs.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

.ci/compile.sh

@@ -175,9 +175,9 @@ fi
 if [[ $MAKE_SANITIZE ]]; then
   flags+=("-DENABLE_SANITIZERS=ON")
 else
-  # The release-package step re-runs cmake in the same build dir, so an
-  # ENABLE_SANITIZERS=ON left over from the debug step would otherwise leak
-  # into the shipped binaries (libasan/libubsan Depends in the DEB).
+  # Every leg states the flag explicitly rather than relying on the CMake
+  # default, so a build directory reused from a sanitized configuration can
+  # never leak libasan/libubsan into a shipped binary.
   flags+=("-DENABLE_SANITIZERS=OFF")
 fi
 if [[ $MAKE_COVERAGE ]]; then