ci: Factor out a template for jobs which run only on the origin repo

This clarifies the intent of the `branches@GNOME/glib` selector. It
introduces no functional changes.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

.gitlab-ci.yml

@@ -26,6 +26,16 @@ variables:
   except:
     - tags
 
+# Some jobs run on CI runners which don’t have good isolation between CI jobs,
+# and don’t have much available resource. Limit those jobs to only ones on the
+# origin repository (GNOME/glib), rather than people’s forks. Code in the origin
+# repository can be trusted.
+.only-origin:
+  only:
+    - branches@GNOME/glib
+  except:
+    - tags
+
 # Some jobs take a long time and are unlikely to find failures (or will find
 # failures which are not merge-blockers to fix), so they’re executed on a weekly
 # schedule in order to save CI resources and speed up branch pipelines.
@@ -367,9 +377,8 @@ vs2017-x64-static:
       - "_build/${env:CI_JOB_NAME}-report.xml"
 
 freebsd-12-x86_64:
+  extends: .only-origin
   stage: build
-  only:
-    - branches@GNOME/glib
   tags:
     # To run a FreeBSD builder, install gitlab-runner package and start both
     # gitlab-runner and dbus service because we need /var/lib/dbus/machine-id.
@@ -398,8 +407,6 @@ freebsd-12-x86_64:
     - meson ${MESON_COMMON_OPTIONS} --localstatedir=/var -Db_lundef=false -Diconv=external -Dxattr=false _build
     - ninja -C _build
     - bash -x ./.gitlab-ci/run-tests.sh
-  except:
-    - tags
   artifacts:
     reports:
       junit: "_build/${CI_JOB_NAME}-report.xml"
@@ -412,9 +419,8 @@ freebsd-12-x86_64:
       - "_build/${CI_JOB_NAME}-report.xml"
 
 freebsd-13-x86_64:
+  extends: .only-origin
   stage: build
-  only:
-    - branches@GNOME/glib
   tags:
     - freebsd-13
   needs: []
@@ -428,8 +434,6 @@ freebsd-13-x86_64:
     - meson ${MESON_COMMON_OPTIONS} --localstatedir=/var -Db_lundef=false -Diconv=external -Dxattr=false _build
     - ninja -C _build
     - bash -x ./.gitlab-ci/run-tests.sh
-  except:
-    - tags
   artifacts:
     reports:
       junit: "_build/${CI_JOB_NAME}-report.xml"
@@ -442,10 +446,8 @@ freebsd-13-x86_64:
       - "_build/${CI_JOB_NAME}-report.xml"
 
 macos:
-  extends: .only-default
+  extends: .only-origin
   stage: build
-  only:
-    - branches@GNOME/glib
   tags:
     - macos
   needs: []