docker: split CA and client into two separate targets

Change-Id: I62ad850f0415e2e161e00fb75ff2d25536888458
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 6f7b9ab..a117fbe 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -13,7 +13,22 @@
   id-token: write
 
 jobs:
-  ndncert:
+  ndncert-build:
     uses: named-data/actions/.github/workflows/docker-image.yml@v1
     with:
-      name: ndncert
+      name: ndncert-build
+      target: build
+  ndncert-ca:
+    needs: ndncert-build
+    uses: named-data/actions/.github/workflows/docker-image.yml@v1
+    with:
+      name: ndncert-ca
+      target: ca
+      contexts: build=docker-image://${{ needs.ndncert-build.outputs.image }}
+  ndncert-client:
+    needs: ndncert-build
+    uses: named-data/actions/.github/workflows/docker-image.yml@v1
+    with:
+      name: ndncert-client
+      target: client
+      contexts: build=docker-image://${{ needs.ndncert-build.outputs.image }}