GitOps GitHub workflow: Enable high-security mode so that secrets are not available to contributors

[getvictor]

Goal

User story
As an IT admin at a high-security organization,
I want to lock down my GitOps GitHub/GitLab workflow
so that a mistake (or malicious insider) cannot modify my Fleet settings.

This was brought up by a contributor. Potential solution mentioned in this comment

Key result

Original requests

Context

• Product Designer: _________________________

Changes

Product

• UI changes: TODO
• CLI (fleetctl) usage changes: TODO
• YAML changes: TODO
• REST API changes: TODO
• Fleet's agent (fleetd) changes: TODO
• GitOps mode changes: TODO
• Activity changes: TODO
• Permissions changes: TODO
• Changes to paid features or tiers: TODO
• My device and fleetdm.com/better changes: TODO
• First draft of test plan added
• Other reference documentation changes: TODO
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.