Add 'allow-secrets' pipeline attribute

This permits an operator to specify that a given pipeline should
never run a job with secrets.  This may be used, for example, to
ensure that no one adds, say, the pypi-upload job to a check
pipeline and then uses that to expose credentials.

Change-Id: I606a76fe9ed19bb87d78f07195fb3950805e8726
4 files changed