Add a new template which defines jobs which must be run in *all*
pipelines, enforced by a pipeline execution policy. As these jobs will
run in all pipelines they must be suitable to run in all possible
projects. This means they must scan only the repository contents and not
assume that any particular flavour of build asset will be present.

Since this template includes jobs from Auto DevOps, it is likely, once
enabled, that we will need to modify `auto-devops.gitlab-ci.yml` to
*remove* the security jobs added by the new mandatory template so that
we do not get duplicate jobs being added to pipelines.

In the meantime, while we test, duplicate jobs are benign, they're just
a waste of resources.

feat: add mandatory jobs template

Closes #138

See merge request !176