Restrict automatic runs of PR jobs

[bensze01]

Only run PR job if one of the following is true:

• The author of the PR has write access to the repo the PR is targeting
• The job is triggered by the Github merge queue (thus the PR has been reviewed by a gatekeeper)
• The job was started manually from the Jenkins UI

Test runs:

• Push to a PR authored by a non-member (PR-merge):
  • Internal CI
  • OpenCI
• Manual run of a PR by a non-member (PR-merge):
  • Internal CI
  • OpenCI
• Manual run of a PR with an expected failure (PR-head):
  • Internal CI
• Push to a PR authored by a team-member (PR-head).
  • Internal CI
  • OpenCI

[bensze01]

@gilles-peskine-arm @paul-elliott-arm I've updated the PR descriptions with the test runs I've run so far. Is there anything else I didn't cover that you would like to see tested before we merge this?

[gilles-peskine-arm]

I started a test run with an expected failure, to make sure we haven't somehow broken the error reporting path. If that works as expected (as well as the pass-expected test runs that are still running), then I'm happy with the testing.

[gilles-peskine-arm]

I've looked at the CI results and they look fine to me. Ok to merge if Paul agrees.

[paul-elliott-arm]

Agreed, everything looks good. Merging.