Correct how jobs are disabled for multi-stage

See merge request !114

Corrects the way jobs are disabled for multi-stage builds to ensure all
jobs needed get run correctly.

Disable release-it in multi-stage builds

See merge request !113

Disables release-it from running in the multi-stage child build
pipelines, the release-it job should run in the parent pipeline only.

Prevent overriding registry location

See merge request !112

Prevents the CI_ARTIFACT_REGISTRY_REPOSITORY environment variable being
overriden in the artifact-registry jobs if it was previously set.

fix: .terraform-plan job

Closes #95

See merge request !111

feat(release-it): tweak template to be common pipeline amenable

Closes #94

See merge request !109

As noted in #94, release-it was not yet present in the common pipeline
which was a blocker of the vision of "OpenAPI client generation releases
are zero-configuration". #94 also noted that not much had to be done to
add release-it to the common pipeline.

Gate the release-it jobs behind the presence of a `.release-it.json`
file in the root of the repository. This should have zero effect on
current users since that file needs to be present in order to use
release-it. Guard against inadvertent triggering by allowing jobs to be
explicitly disabled via a `RELEASE_IT_DISABLED` variable.

To guard against future namespace clashes, namespace all the release-it
jobs. In #94, it was originally suggested that the
`USE_MERGE_REQUEST_RELEASE_FLOW` variable could be namespaces and given
the backup value of `USE_MERGE_REQUEST_RELEASE_FLOW` to avoid breaking
clients but, upon reflection, having *two* variables controlling this
behaviour adds more confusion than it prevents. As such, leave the
variable un-namespaced as an interesting historical remnant.

feat: add OpenAPI generator template

See merge request !110

As part of [the releated Activate Account epic][1] a generic template
was created to allow OpenAPI clients to be generated from YAML schemata.

#93 covers moving this
template to the ci-templates repo and documenting it in the guidebook.
This provides the ci-template-side part of that issue.

The actual content is a straight copy-paste from the upstream template
and so should require minimal review.

[1]: uis/devops&205
[2]: https://gitlab.developers.cam.ac.uk/uis/devops/iam/activate-account/api/-/blob/main/.gitlab/openapi-generator.gitlab-ci.yml?ref_type=heads

chore: move GCP secrets documentation to guidebook

See merge request !108

This does not warrant a release.

feat: add new trigger-renovatebot job

See merge request !107

Add a new CI job to the common pipeline which triggers a run of
renovatebot for the CI pipeline's project if the
TRIGGER_RENOVATEBOT_ENABLED variable is set.

Since no jobs are added *unless* that variable is set, this ensures that
renovatebot runs are always explicitly triggered.

The auto-devops/trigger-renovatebot.yml template also includes a
template CI job which can be used to construct trigger jobs with more
elaborate rulesets.

fix: container scanning when using multi target docker images

See merge request !106

Combined maven pipeline configs from WRS and Java Common into a new common template

See merge request !104

fix(multi-target-docker-images): set env variables through before_script

See merge request !105