Dockerfile: install gh from Homebrew

apt installs an ancient `gh` that is missing some important flags. In
particular, we probably do want the `--match-head-commit` flag for the
extra security it gives us.