feat: add mandatory jobs template

Add a new template which defines jobs which must be run in all pipelines, enforced by a pipeline execution policy. As these jobs will run in all pipelines they must be suitable to run in all possible projects. This means they must scan only the repository contents and not assume that any particular flavour of build asset will be present.

Since this template includes jobs from Auto DevOps, it is likely, once enabled, that we will need to modify auto-devops.gitlab-ci.yml to remove the security jobs added by the new mandatory template so that we do not get duplicate jobs being added to pipelines.

In the meantime, while we test, duplicate jobs are benign, they're just a waste of resources.

Closes #138 (closed).