of_dockerfile needs to read a parsed Dockerfile, but only the abstract t was
exposed. Add Dockerfile.instructions : t -> instruction list -- a curated,
builder-friendly view (From/Run/Cmd/Copy/Env/...), folding the rare cases into
Other rather than leaking the internal line AST.

A Run carries its BuildKit modifiers -- command, network, security, and a
curated run_mount list (Cache/Bind/Secret/Ssh/Tmpfs) -- so a build front-end can
map them onto its own notions (e.g. obuilder's cache and network). The parser
now understands RUN --mount=type=cache,target=...,id=..., --network=none|host,
and --security=insecure|sandbox: it strips those flags before the command, and
they round-trip through to_string.

Dockerfile.of_string parses a Dockerfile back into a Dockerfile.t: an ocamllex
lexer splits logical lines (joining backslash continuations, handling comments
and blanks), a thin menhir grammar collects them, and an interpreter maps each
to the eDSL builders. Both shell and exec (JSON-array) forms of RUN/CMD/
ENTRYPOINT are handled, COPY/ADD accept the shell and JSON forms, and FROM keeps
a registry-port host distinct from a tag. of_string is total -- arbitrary bytes
yield Ok/Error, never an exception.

Tests cover parse/print round-trip, line continuation, registry-port FROM, and
clean errors. Fuzz (alcobar) round-trips generated Dockerfiles and asserts the
parser never raises on random input.

Renames the opam package to nox-dockerfile (the bare dockerfile name is
upstream's), matching the nox-* convention; dir, library and Dockerfile module
are unchanged.