Handling ECP mirrors

We need to figure out and document our approach to ECP mirrors and external gitlab runners.

Given the current constraints, I would recommend something using

• gitlab environments
• a set of protected staging/production branches
• a separate ecp-ci pipeline that only runs on master and those other protected branches
• a way to link external pipeline status into this gitlab instance

See this: https://docs.gitlab.com/ee/workflow/gitlab_flow.html#production-branch-with-gitlab-flow