Restrict wheel publish jobs

Only allow requirements to run the wheel publish jobs.  This used to
be set on the build jobs, but we moved them to openstack-zuul-jobs so
they could be speculatively tested.

It makes sense to run the build jobs in the openstack-zuul-jobs gate
when the wheel build scripts are updated.

Thus move the allowed-projects to the publish jobs, which are actually
the bits that only requirements updates should write out.

See also Ica59634eec533db20fe8b1dd148ee9b4d041fd3c

Change-Id: I0574b69090409a6cd3f09f533a4dd7f710f89d2c

zuul.d/jobs.yaml

@@ -855,6 +855,8 @@
     parent: build-wheel-mirror-centos-7
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -880,6 +882,8 @@
     parent: build-wheel-mirror-centos-8
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -905,6 +909,8 @@
     parent: build-wheel-mirror-centos-8-arm64
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -934,6 +940,8 @@
     parent: build-wheel-mirror-debian-buster
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -963,6 +971,8 @@
     parent: build-wheel-mirror-debian-buster-arm64
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -988,6 +998,8 @@
       Publish Ubuntu Focal wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1013,6 +1025,8 @@
       Publish Ubuntu Focal wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1042,6 +1056,8 @@
       Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1071,6 +1087,8 @@
       Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1100,6 +1118,8 @@
       Publish Ubuntu Xenial wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1129,6 +1149,8 @@
       Publish Ubuntu Xenial ARM64 wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs