Fail if Zuul v2 frozen files are touched

We still have contributors that touch zuul/layout.yaml or jenkins/jobs -
let's fail those.

Mark the job as non-voting for now.

Change-Id: I0c195c7c0bfd0af24e2d796b2863ec4166a2235f

playbooks/frozen-v2/run.yaml

@@ -0,0 +1,10 @@
+- hosts: all
+  tasks:
+    - shell: |
+        echo "Do not touch jenkins/jobs or zuul/layout.yaml."
+        echo "These files are frozen."
+        echo "Instead change the Zuul v3 files as explained at"
+        echo "https://docs.openstack.org/infra/manual/zuulv3.html ."
+        echo "While we're in the v2 to v3 transition, changes to v2 files"
+        echo "are only possible with a corresponding change for the v3 files."
+        exit 1

zuul.d/jobs.yaml

@@ -439,3 +439,14 @@
     files:
       - zuul/main.yaml
       - gerrit/projects.yaml
+
+- job:
+    name: project-config-frozen-files
+    description: |
+      Check for frozen Zuul v2 files.
+    run: playbooks/frozen-v2/run.yaml
+    allowed-projects:
+      - openstack-infra/project-config
+    files:
+      - zuul/layout.yaml
+      - ^jenkins/jobs/.*

zuul.d/projects.yaml

@@ -1043,6 +1043,8 @@
         - zuul-migrate:
             files:
               - zuul/mapping.yaml
+        - project-config-frozen-files:
+            voting: false
         - legacy-bindep-fallback-centos-7:
             branches: master
             files: