fix: introduce per-job cert volume with %gcl% token

Jobs using docker:dind as a service share TLS client certificates via a
named volume. The previous approach relied on a static volume name (e.g.
`certs`) configured in .gitlab-ci-local-env, which caused race conditions
when concurrent jobs wrote to and cleaned up the same volume.

A new `%gcl%:` prefix in VOLUME entries is now resolved at runtime to a
per-job unique volume name (`gcl-<job>-<id>-cert`), matching the naming
pattern of the existing build/tmp volumes. The `%gcl%` token was chosen
because Docker hard-rejects it if it ever reaches the daemon unsubstituted
(invalid volume name character), rather than silently bind-mounting an
unintended host path.

Changes:
- get certVolumeName() getter returning a per-job unique name
- Cert volume is created and registered for cleanup alongside build/tmp
  volumes when any %gcl%: entry is present in argv.volume
- %gcl%: prefix is resolved to certVolumeName in both the job container
  and service container volume loops

Author: ticapix

src/job.ts

@@ -468,6 +468,10 @@ If you know what you're doing and would like to suppress this warning, use one o
         return this.jobData["needs"] ?? null;
     }
 
+    get certVolumeName (): string {
+        return `gcl-${this.safeJobName}-${this.jobId}-cert`;
+    }
+
     get buildVolumeName (): string {
         return `gcl-${this.safeJobName}-${this.jobId}-build`;
     }
@@ -689,10 +693,15 @@ If you know what you're doing and would like to suppress this warning, use one o
             const fileVariablesDir = this.fileVariablesDir;
 
             this._containerVolumeNames.push(buildVolumeName, tmpVolumeName);
-            await Promise.all([
+            const volumeCreatePromises = [
                 Utils.spawn([this.argv.containerExecutable, "volume", "create", `${buildVolumeName}`], argv.cwd),
                 Utils.spawn([this.argv.containerExecutable, "volume", "create", `${tmpVolumeName}`], argv.cwd),
-            ]);
+            ];
+            if (this.argv.volume.some(v => v.startsWith("%gcl%:"))) {
+                this._containerVolumeNames.push(this.certVolumeName);
+                volumeCreatePromises.push(Utils.spawn([this.argv.containerExecutable, "volume", "create", this.certVolumeName], argv.cwd));
+            }
+            await Promise.all(volumeCreatePromises);
 
             const time = process.hrtime();
             this.refreshLongRunningSilentTimeout(writeStreams);
@@ -1017,7 +1026,8 @@ If you know what you're doing and would like to suppress this warning, use one o
             dockerCmd += `--workdir ${this.ciProjectDir} `;
 
             for (const volume of this.argv.volume) {
-                dockerCmd += `--volume ${volume} `;
+                const v = volume.startsWith("%gcl%:") ? `${this.certVolumeName}${volume.slice("%gcl%".length)}` : volume;
+                dockerCmd += `--volume ${v} `;
             }
 
             for (const extraHost of this.argv.extraHost) {
@@ -1580,7 +1590,8 @@ If you know what you're doing and would like to suppress this warning, use one o
         }
 
         for (const volume of this.argv.volume) {
-            dockerCmd += `--volume ${volume} `;
+            const v = volume.startsWith("%gcl%:") ? `${this.certVolumeName}${volume.slice("%gcl%".length)}` : volume;
+            dockerCmd += `--volume ${v} `;
         }
 
         for (const extraHost of this.argv.extraHost) {