fix(ci): actually test kernel builds if patches are added

The patches are in the `patches` subdirectory of `hiding_ci`, so if only
patches were added, then the check of "any files with parent directory
`hiding_ci`" would be false, and the CI step for testing the build of
patches wouldn't actually run.

Fix this by updating the check to be "any files where any parent
directory is `hiding_ci`", which will also catch patches.

Reported-by: Jack Thomson <jackabt@amazon.co.uk>
Signed-off-by: Patrick Roy <roypat@amazon.co.uk>

Author: roypat

.buildkite/pipeline_pr.py

@@ -68,7 +68,9 @@
     for step in kani_grp["steps"]:
         step["label"] = "🔍 Kani"
 
-if not changed_files or (any(x.parent.name == "hiding_ci" for x in changed_files)):
+if not changed_files or (
+    any(parent.name == "hiding_ci" for x in changed_files for parent in x.parents)
+):
     pipeline.build_group_per_arch(
         "🕵️ Build Secret Hiding Kernel",
         pipeline.devtool_test(