Add support for job allowed-projects

In order to allow users to create jobs which are only available to
run on certain projects, add an 'allowed-projects' attribute to
jobs.  This is especially useful for jobs with secrets.  For example,
consider a job which performs external API testing with credentials.
The user defining that job may well want to restrict its use to a
single project.

Change-Id: I4457842ea293baf20b83f7b8b86fba2b7d26d2be
diff --git a/zuul/model.py b/zuul/model.py
index 47f20ef..846463b 100644
--- a/zuul/model.py
+++ b/zuul/model.py
@@ -764,6 +764,7 @@
             final=False,
             roles=frozenset(),
             repos=frozenset(),
+            allowed_projects=None,
         )
 
         # These are generally internal attributes which are not
@@ -2355,6 +2356,10 @@
                 # A change must match at least one project pipeline
                 # job variant.
                 continue
+            if (frozen_job.allowed_projects and
+                change.project.name not in frozen_job.allowed_projects):
+                raise Exception("Project %s is not allowed to run job %s" %
+                                (change.project.name, frozen_job.name))
             job_graph.addJob(frozen_job)
 
     def createJobGraph(self, item):