Self-serve: GitLab CI ID tokens, one variable, no RansomLeak signup
Adds SonarQube support: optional sonarqube component and gl-sonarqube-report.json in the training job.